How to mirror port only http get packet on 4948 or 6500 ?

[hatman]

Hello,

How to mirror port only http get packet on 4948 or 6500 ?

[Vivek Ganapathi]

Hello,

You wouldn't be able to sniff just HTTP get. But you can filter only HTTP get requests on the sniffing tool you are using. What i want to say is, on 4900 or 6500, you wouldn't be able to create a SPAN port based on your required parameters.

Thanks

Vivek

[epelser_2]

Hi.

I believe Vivek is correct.

I don't know exactly what you want to achieve but as far as I'm aware your options are as follows:

1) Capture traffic as per Vivek's suggestion and filter within your analyser tool.

2) Use the 6500s mini protocol analyzer tool to filter to a destination IP or if you require further granularity, between source and destination IP.

See the following link for the info on the mini analyzer.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/8.x/configuration/guide/span.html#wp1038600

I don't believe the 4900 has the same functionality thought.

I hope this helps

Ernst

[hatman]

Hi,

I want to mirror only http get traffic

for the currently

am use function vlan access-map on 6500 for classify destination port rq 80 ( include http get and http upload)

the traffic is very hight and our server can't handle all the traffic.

and then i want to find the best solution for classify the http packet -- am not sure i can classify packet by packek lenght  support or not?

[Ven Taylor]

I believe what you're looking to do is set up a Vlan Access List (VACL).

You can set up the access list to trigger on any type of traffic and then capture the output.

We do it here all the time to sniff traffic.  I'm not sure what you want to do with the traffic, but this will let you span a vlan to a switchport for monitoring/sniffer work.

#create an acl that references all interesting traffic

ip access-list extended capture-http

permit tcp any eq www any eq www

!

exit

!

#apply rules and reference acl

vlan access-map capture-http 10

match ip address capture-http

action forward capture

exit

!

#apply your vacl to a particular vlan (in this case 100)

vlan filter capture-http vlan-list 100

!

exit

!

#apply your vacl to a port with the sniffer

interface Gig3/1

description Sniffer

switchport

switchport mode access

switchport capture

spanning-tree portfast

end

Put your sniffer on t

Here's a link to some configuration examples:

http://www.cisco.com/en/US/tech/tk389/tk814/tk838/tsd_technology_support_sub-protocol_home.html

Ven