01-10-2012 01:16 PM - edited 03-07-2019 04:16 AM
Hello
I have a switch 4948, with version 12.2.31.sga4 ( I dont found bug about monitor session) and we try to made port mirroring with a monitor session from a VLAN and port belong at this VLAN have traffic input and output, but in the destination port, I always see it output traffic..
Global command
Red-127#sh run | in moni
monitor session 1 source vlan 1127
monitor session 1 destination interface Gi1/24
I test the command "Monitor session 1" with both and rx, but only see output traffic in the interface gi 1/24. Sombody know if need other parameter in the global cofiguration or is a bug...
Thanks
PORT OF VLAN 1127
Red-127#sh run int gigabitEthernet 1/1
Building configuration...
Current configuration : 313 bytes
!
interface GigabitEthernet1/1
description DEMO-TOIP
switchport access vlan 1127
switchport mode access
speed 100
duplex full
qos trust cos
auto qos voip trust
tx-queue 3
bandwidth percent 33
priority high
shape percent 33
spanning-tree portfast
service-policy output autoqos-voip-policy
end
Red-127#sh int gigabitEthernet 1/1
GigabitEthernet1/1 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet Port, address is 0022.901d.a180 (bia 0022.901d.a180)
Description: DEMO-TOIP
MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, link type is auto, media type is 10/100/1000-TX
input flow-control is off, output flow-control is off
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:54, output never, output hang never
Last clearing of "show interface" counters 5w4d
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 18
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 5000 bits/sec, 8 packets/sec
5 minute output rate 9000 bits/sec, 14 packets/sec
28943337 packets input, 6481394796 bytes, 0 no buffer
Received 57968 broadcasts (56558 multicasts)
0 runts, 0 giants, 0 throttles
DESTINATION PORT
Red-127#sh run int gigabitEthernet 1/24
Building configuration...
Current configuration : 37 bytes
!
interface GigabitEthernet1/24
end
Red-127#sh int gigabitEthernet 1/24
GigabitEthernet1/24 is up, line protocol is down (monitoring)
Hardware is Gigabit Ethernet Port, address is 0022.901d.a197 (bia 0022.901d.a197)
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, link type is auto, media type is 10/100/1000-TX
input flow-control is on, output flow-control is off
ARP type: ARPA, ARP Timeout 04:00:00
Last input 1y19w, output never, output hang never
Last clearing of "show interface" counters 5w4d
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 113000 bits/sec, 77 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
924236 packets output, 185876150 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
Solved! Go to Solution.
01-11-2012 07:26 AM
When you configure SPAN, the SPAN source ports rx/tx traffic will be mirrored towards the SPAN destination port.
This mirrored traffic will be seen as egress on the SPAN destination port.
The SPAN destination port will not accept ingress packets.
Regards,
Edison
01-10-2012 01:34 PM
That's expected. That's SPAN'd traffic being sent to the monitor station to be analyzed.
01-11-2012 06:06 AM
Hi Edison
You mean that this output traffic is the expected, despite that the source interface have input and output traffic, and the global command "monitor session 1" with the "both" alternative? is this the normal output from the command "monitor session"?
Becouse, I can't see the input traffic..
Thanks..
Rodrigo
01-11-2012 07:26 AM
When you configure SPAN, the SPAN source ports rx/tx traffic will be mirrored towards the SPAN destination port.
This mirrored traffic will be seen as egress on the SPAN destination port.
The SPAN destination port will not accept ingress packets.
Regards,
Edison
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide