I have set up two local SPAN sessions on 6509 VSS already. Recently, I need to set up one more SPAN sessions to mirror two routers (173.105.85.5 &.6) traffic to a sniffer software for traffic analysis. I researched that there is other ways to do the traffic capture by reading the following reading.
http://www.cisco.com/c/en/us/support/docs/lan-switching/vlan-access-lists-vacls/89962-vacl-capture.html#vacl_config
I drafted the following commands according to my understanding. May any expertise tell me whether they are correct?
ip access-list extended DC20M_DATA
Cat6K-IOS(config-ext-nacl)#permit ip any 173.105.85.5 ; router_5 lan ip
Cat6K-IOS(config-ext-nacl)#permit ip any 173.105.85.6 ; router_6 lan ip
Cat6K-IOS(config-ext-nacl)#exit
Cat6K-IOS(config)#vlan access-map DC20M_DATA_MAP 10 ; Define the VLAN access map.
Cat6K-IOS(config-access-map)#match ip address DC20M_DATA
Cat6K-IOS(config-access-map)#action forward
Cat6K-IOS(config-access-map)#exit
Cat6K-IOS(config)#vlan filter DC20M_DATA_MAP vlan-list 100,101,300,410-440,490 ; multiple vlan traffic is specified for filtering.
Cat6K-IOS(config)#int Gi1/3/35 ; destination span port.
Cat6K-IOS(config-if)#switchport capture allowed vlan 100
Cat6K-IOS(config-if)#switchport capture
Cat6K-IOS(config-if)#exit
Please advise. Thanks.
