monitor session 2 source vlan 2 vs. monitor session 2 filter vlan 2??

[FLOPACES11]

Can someone please tell me the difference between these commands for setting up a SPAN monitoring session on a Cisco 4500X series MLS? i am prepping for my CCNP switch and a practice exam has this question on it with no explanation on why one is right vs. the other. From my current knowledge, they both should accomplish the exact same results, but Cisco says not.. Please help me out on this one

monitor session 2 source vlan 2 vs. monitor session 2 filter vlan 2

[burleyman · Accepted solution]

Let's say you have a switch with say 5 ports on VLAN 2 and you want to monitor all that traffic. You would use the "monitor session 2 source vlan 2" command.

Now let's say you want to monitor a trunk port but you only want to see the traffic that is in VLAN 2 you would use the " monitor session 2 filter vlan 2" this would just show you the traffic across the trunk that is VLAN 2 traffic.

Mike

[FLOPACES11]

Mike,

So if im understanding correctly, the monitor session 2 vlan is used to monitor ALL ports in specific vlans and the monitor session 2 filter vlan is used to monitor vlan traffic on a SINGLE port? i think this is starting to make perfect sense now. Thanks for your quick response and expertise Mike!

[burleyman · Accepted solution]

No quite but almost.

You are correct about the "monitor session 2 vlan 2" is to monitor ALL port in VLAN 2.

but remember a trunk is not part of the VLAN so you will not see vlan 2 traffic from the trunk port.

If you want to monitor a trunk port but only care about the traffic on VLAN 2 then you would use the "monitor session 2 filter vlan 2" and you would see JUST the vlan 2 traffic on the trunk.

Mike

[FLOPACES11]

Perfect. Thanks again Mike