cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4491
Views
5
Helpful
3
Replies

Monitor Session in a 4948 dont show input traffic

rc5295509
Level 1
Level 1

Hello

I have a switch 4948, with version 12.2.31.sga4 ( I dont found bug about monitor session)  and we try to made port mirroring with a monitor session from a VLAN and port belong at this VLAN have traffic input and output, but in the destination port, I always see it output traffic..

Global command

Red-127#sh run | in moni

monitor session 1 source vlan 1127

monitor session 1 destination interface Gi1/24

I test the command "Monitor session 1" with both and rx, but only see output traffic in the interface gi 1/24. Sombody know if need other parameter in the global cofiguration or is a bug...

Thanks

PORT OF VLAN 1127

Red-127#sh run int gigabitEthernet 1/1

Building configuration...

Current configuration : 313 bytes

!

interface GigabitEthernet1/1

description DEMO-TOIP

switchport access vlan 1127

switchport mode access

speed 100

duplex full

qos trust cos

auto qos voip trust

tx-queue 3

   bandwidth percent 33

   priority high

   shape percent 33

spanning-tree portfast

service-policy output autoqos-voip-policy

end

Red-127#sh int gigabitEthernet 1/1

GigabitEthernet1/1 is up, line protocol is up (connected)

  Hardware is Gigabit Ethernet Port, address is 0022.901d.a180 (bia 0022.901d.a180)

  Description: DEMO-TOIP

  MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec,

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 100Mb/s, link type is auto, media type is 10/100/1000-TX

  input flow-control is off, output flow-control is off

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input 00:00:54, output never, output hang never

  Last clearing of "show interface" counters 5w4d

  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 18

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  5 minute input rate 5000 bits/sec, 8 packets/sec

  5 minute output rate 9000 bits/sec, 14 packets/sec

     28943337 packets input, 6481394796 bytes, 0 no buffer

     Received 57968 broadcasts (56558 multicasts)

     0 runts, 0 giants, 0 throttles

DESTINATION PORT

Red-127#sh run int gigabitEthernet 1/24

Building configuration...

Current configuration : 37 bytes

!

interface GigabitEthernet1/24

end

Red-127#sh int gigabitEthernet 1/24

GigabitEthernet1/24 is up, line protocol is down (monitoring)

  Hardware is Gigabit Ethernet Port, address is 0022.901d.a197 (bia 0022.901d.a197)

  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 1000Mb/s, link type is auto, media type is 10/100/1000-TX

  input flow-control is on, output flow-control is off

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input 1y19w, output never, output hang never

  Last clearing of "show interface" counters 5w4d

  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  5 minute input rate 0 bits/sec, 0 packets/sec

  5 minute output rate 113000 bits/sec, 77 packets/sec

     0 packets input, 0 bytes, 0 no buffer

     Received 0 broadcasts (0 multicasts)

     0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 input packets with dribble condition detected

     924236 packets output, 185876150 bytes, 0 underruns

     0 output errors, 0 collisions, 0 interface resets

     0 babbles, 0 late collision, 0 deferred

     0 lost carrier, 0 no carrier

     0 output buffer failures, 0 output buffers swapped out

1 Accepted Solution

Accepted Solutions

When you configure SPAN, the SPAN source ports rx/tx traffic will be mirrored towards the SPAN destination port.

This mirrored traffic will be seen as egress on the SPAN destination port.

The SPAN destination port will not accept ingress packets.

Regards,

Edison

View solution in original post

3 Replies 3

Edison Ortiz
Hall of Fame
Hall of Fame

That's expected. That's SPAN'd traffic being sent to the monitor station to be analyzed.

Hi Edison

You mean that this output traffic is the expected, despite that the source interface have input and output traffic, and the global command "monitor session 1" with the "both" alternative?  is this the normal output from the command "monitor session"?

Becouse, I can't see the input traffic..

Thanks..

Rodrigo

When you configure SPAN, the SPAN source ports rx/tx traffic will be mirrored towards the SPAN destination port.

This mirrored traffic will be seen as egress on the SPAN destination port.

The SPAN destination port will not accept ingress packets.

Regards,

Edison

Review Cisco Networking products for a $25 gift card