Hello,
i have a question regarding monitoring a Trunk Port with the help of a local Span Session on a Catalyst 2960S Switch with Version 12.2(55)SE3.
The scenario looks like the following sheme:
SnifferPC(Wireshark) <-> Telephone(Siemens) <-> Switch(2960S)<-> LAN Distribution Layer
The telephone sends SIP Traffic over VLAN 13 to the Voice Gateway and communicates with Phones over VLAN 13 (RTP)
I am interessted to capture this traffic on the uplink Port of the Switch (Trunk Port) to the LAN Distribution Layer. For this reason, i configured this Local Span:
Session 1
---------
Type : Local Session
Source Ports :
Both : Gi1/0/26
Destination Ports : Gi1/0/2
Encapsulation : Replicate
Ingress : Disabled
Gi1/0/26 is the uplink port to the distribution layer
Gi1/0/2 is the mirror port where the PC with wireshark in promiscous mode is listening.
My problem is, that i see all rtp,sip traffic on the whireshark pc, that is directly connected to the siemens phone. However, i do not see this traffic traversing the Uplink Port on the very same switch. I only see ARP Traffic in that VLAN from the Siemens Phone. I do not see SIP or RTP Traffic at all.
So, for that reason, i created a different Span Session that looks like these
Session 1
---------
Type : Local Session
Source VLANs :
Both : 13
Destination Ports : Gi1/0/2
Encapsulation : Replicate
Ingress : Disabled
Still the same, i can see Traffic RTP and Sip that is leaving the phone, but i see that traffic not on the mirror port, expect of ARP.
Only as additional information, the SIP and RTP is working probably, i am able to establish a valid phone call.
Can someone give me a hint, what i am doing wrong ?
