how can I sniff all traffic of all ports in cisco 3560

[ehudcarmeli]

Is it possible to sniff all ports of the switch?

Let's say I am using 20 ports with total traffic of less than 1G (all together) and I want to connect Wireshark to one of the ports and sniff all traffic from all ports, can this be done? any limitation? If this product doesn't support it which can?

Thanks, Ehud

[Jon Marshall]

Yes you can, see this link - 

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swspan.html

Jon

[ehudcarmeli]

Thank you very much Jon !
Assuming I will use it to monitor physical ports "

For EtherChannel sources, you can monitor traffic for the entire EtherChannel or individually on a physical port as it participates in the port-channel"

will I be able to span all 20+ ports into one port?

Thanks, Ehud

[Jon Marshall]

Yes, if you read the document it does say you can span all ports on the switch. 

Jon

[balaji.bandi]

yes it does :

monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx]

Specify the SPAN session and the source port (monitored port). For session_number, the range is 1 to 66. For interface-id, specify the source port or source VLAN to monitor. For source interface-id, specify the source port to monitor. Valid interfaces include physical interfaces and port-channel logical interfaces (port-channel port-channel-number). Valid port-channel numbers are 1 to 48. • For vlan-id, specify the source VLAN to monitor. The range is 1 to 4094 (excluding the RSPAN VLAN). Note A single session can include multiple sources (ports or VLANs), defined in a series of commands, but you cannot combine source ports and source VLANs in one session. (Optional) [, | -] Specify a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen. (Optional) Specify the direction of traffic to monitor. If you do not specify a traffic direction, the SPAN monitors both sent and received traffic. • both—Monitor both received and sent traffic. This is the default. • rx—Monitor received traffic. • tx—Monitor sent traffic. Note You can use the monitor session session_number source command multiple times to configure multiple source ports.

[S Kumar]

Lets say you connected the Wireshark at port # 24 and you want to sniff from port # 1 thru 23.

monitor session 1 source interface Gi1/0/1 - 23
monitor session 1 destination interface Gi1/0/24

[Joseph W. Doherty]

My read of the documentation would be, you'll need to:

monitor session 1 source interface Gi1/0/1
monitor session 1 source interface Gi1/0/2
.
.
monitor session 1 source interface Gi1/0/23
monitor session 1 destination interface Gi1/0/24

[balaji.bandi]

Unfortunately there is no range command works for source ports