Monitor session & filter access list 2960x

[loiccruchade]

Hello !

I have a question about monitor sessions and 2960X switches.

I already configured monitor sessions with ip filtering by access list on 3750x switches.
But on my 2960X, i dont have the option to filter by an access list.

I'm using IOS 15.0(2)EX4.

I can do an IOS upgrade, but i can't tell if the option will be there after, and did not find my answer in any documentation.

Thanks for your help !

[Mark Malone]

Hi you check what features/syntax are available on each IOS release here and compare against current versions in place

Either way I would upgrade that's an EX release I would try go to a MD if possible it would be more stable

Big diff as well between a 3750x and 2960x and what they can do , 29s are access layer 37s are dist so would have more options available per feature

http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp

[loiccruchade]

Thanks for your help ! As i see, this feature is not aviable on 2960 series. I have an idea, but it seems a bit stupid to me (or at least, dirty) : Is it possible to send mirrored traffiic to my core, then mirror again applying IP Filter ? thanks again for your help

[Mark Malone]

Hey not with standard span its local to the switch only but from your core you could do an rspan capture and capture the vlan traffic on the remote 2960 switch and filter by vlan as another option if its trunked layer 2 connections between them , the device that's capturing the traffic will need to be connected to the core switch whether its just pc with wirehshark or an actual device specific for capturing traffic as that's where its sent back to collect

A guide for rspan

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/span.html#wp1043935