How to determine if a monitor session is active?

[ttrevino1]

I have two monitor sessions in our 6500, however, I believe only one is active for our content filtering appliance. From the configs below, I'm assuming the first port is the actual port in use for monitoring, while the second isn't in use. Can someone confirm my thoughts?

dragonslayer#sho int gx/x
GigabitEthernetx/x is up, line protocol is down (monitoring)
  Hardware is C6k 1000Mb 802.3, address is (scrubbed)
  Description: ContentFilter T1 span port to firewalls
  MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec,
     reliability 255/255, txload 57/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 100Mb/s
  input flow-control is off, output flow-control is on
  Clock mode is auto
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 46785881
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 22359000 bits/sec, 4847 packets/sec
     1 packets input, 82 bytes, 0 no buffer
     Received 1 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 1 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     2200184033 packets output, 1314352204382 bytes, 0 underruns
     0 output errors, 0 collisions, 3 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out

interface GigabitEthernetx/x
 description ContentFilter T1 span port to firewalls

switchport
 no ip address
 speed 100
 duplex full
end
*************************************************************************************
dragonslayer#sho int gx/x
GigabitEthernetx/x is down, line protocol is down (monitoring)
  Hardware is C6k 1000Mb 802.3, address is (scrubbed)
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed
  input flow-control is off, output flow-control is desired
  Clock mode is auto
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out

interface GigabitEthernetx/x
 switchport
 switchport access vlan 5
 switchport mode access
 no ip address
 no cdp enable
end
 

[Madhukrishnan Gopinathan Nair · Accepted solution]

Hi Ttrevino,

Yes you are right. The second port is down and it is not active.

If you want to use that port in monitoring session, remove it first from span session and check the status of it. I would expect it to be down/down presently. Once you fix it, you can use that again as a destination port by adding it back to span session.

Hope this helps. Please don't forget to rate helpful posts and mark as correct if it answered your question fully.

Thanks,

Madhu.

[Cisco Freak · Accepted solution]

Hey,

The second switchport is physically down. You can verify it with the 'show interface status' command as shown below:

Switch5#sh int status 

Port      Name               Status       Vlan       Duplex  Speed Type
Fa0/1                        notconnect   901          auto   auto 10/100BaseTX
Fa0/2                        notconnect   1            auto   auto 10/100BaseTX

CF