Monitor Fibre Port via Ethernet?

[scott.lancaster]

Hi,

Hoping someone can help

I havea  cisco 3750x fibre switch, and I want to monitor one of the fibre ports via Ethernet in PRTG.

The config I have is 12 fibre ports with SFP (1/0/1 - 12) in them, and an additional 4 ports (1/1/1 -4) , with some SFP that are Ethernet handoffs.

I want to monitor one of the routers that is in 1/1/2

We setup a monitor session  with the source being 1/1/2 and destination of 1/0/12.

In port 1/0/12, I have a sfp connected via fibre to a fibre to Ethernet convertor,  THe Ethernet cable from there is plugged into a PRTG machine on the second NIC

When I try to monitor this, I am not seeing any large amounts of traffic on the port.  I know there is traffic, as its our main router.

Is there any issue with the config I have setup? Any reason why I may not be able to see the traffic from 1/1/2 ? 

I am thinking that maybe we cannot see the traffic from a fibre port when its been converted back to Ethernet?

I used the commands below to setup:

monitor session 1 source interface Gi1/1/2

monitor session 1 destination interface Gi1/0/12

Any help is greatly appriciated

[Mark Malone]

Hi

to quickly rule out the prtg open up wireshark on same pc that's connected to g1/0/12 an use that NIC and see if you see traffic coming in , its a span session not sure what way prtg sees it but wireshark will confirm if its working properly  , span doesn't care whether its Ethernet or fibre its probably something else  

also check your port g1/0/12 is in monitoring status

and check the show monitor session is ok

[scott.lancaster]

Yeah wireshark is not seeing the traffic either.   How do I check that g1/0/12 is in monitoring status? 

I run show mon and it shows the config I entered is setup.

[Mark Malone]

You just check the interface as below , did you try the first NIC too ?

xxxxxxxxxxx#sh int g1/8/48
GigabitEthernet1/8/48 is up, line protocol is down (monitoring)

[scott.lancaster]

Thanks for al the help, really appreciate it

Yes interface is in monitoring mode.

I checked from wireshark and prtg, and i do see a lot UDP traffic but thats all

Here is the interface config.. could it be something to do with the interface config. (i am showing other show you see) 

Destination:

!
interface GigabitEthernet1/0/10
 switchport trunk encapsulation dot1q
 switchport mode trunk
 speed nonegotiate
 channel-protocol lacp
 channel-group 1 mode passive
!
interface GigabitEthernet1/0/11
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/0/12
!

Source:

interface GigabitEthernet1/1/2
 description Macquarie Secondary Router
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 1,8,9
 switchport mode trunk

Monitor Config

monitor session 1 source interface Gi1/1/2
monitor session 1 destination interface Gi1/0/12

end

[Mark Malone]

Hmm its seeing UDP it should be working then , span doesn't distinguish against diff types of traffic it just collects whatever's on the wire real time , a quick test try send an extended ping across the source interface being monitored up to your router and see if you see ICMP traffic in the wireshark it should show up live ?

Is the prtg machine windows or Linux and just to confirm you tried both nics just incase its having an issue with one of them ?

Your config looks fine your just capturing a source trunk interface and the when a port goes into monitoring status for destination it negates any config under it anyway as its gone span mode to collect traffic so I don't think the issue is with that

[scott.lancaster]

Thanks.  I will try that out.  Perhaps its the Fibre to Ethernet Convertor playing up.  at least i know the config is ok now.

Appreciate the help.

Scott

[Mark Malone]

Yes cool let us know if you get it working , last resort if everything is ruled out is try another ios version but it sounds as if its working as UDP traffic is flowing through , when its not working usually you just see your own pc traffic bundled in mostly dns and arp packets back and forth