01-11-2012 08:18 PM - edited 03-07-2019 04:18 AM
Hi Guys,
i need to monitor any traffic flowing thru the trunks between two switches ( port- channel configured) . Do i want to use "encapsulation replicate" with monitor destination
monitor sess 1 source po 1 both
monitor sess 1 destination int fa 0/1 encapsulation replicate
or with out
monitor sess 1 source po 1 both
monitor sess 1 destination int fa 0/1
Please advice.
Thanks
01-12-2012 12:38 AM
Hi,
If you want to do packet capture then below command is enough.
monitor session 1 destination int fa 0/1
In the portchannel you must be having multiple fastethernet port bundled and the traffic may or may not be more than 100 mbps. The destination port is only 100 mbps fastethernet port. Hence, if you connect a machine there you may face output packet drops on the destination port and not all packets would be captured.
Regards,
Talha
01-12-2012 12:49 AM
Hi,
I would agree to Talha "monitor session 1 destination int fa 0/1" would be sufficient. But if you have encapsulation replicate, you can capture the tagged packets in the SPAN session and see it on the destination port. Since you are sniffing a trunk port, I think you would need "encapsulation replicate" in your SPAN destination configuration.
Regards,
ranraju
01-12-2012 07:18 PM
Thanks. for the reply.
when i tried to configure RSPAN & SPAN as source in same monitor session, i get below error. is that mean we cannot configure SPAN & RSPAN as source in same monitor session
"% Cannot add RSPAN VLAN as source for SPAN session 1 as it is not a RSPAN Destination session "
my intention is to replicate all the vlan 61 & 73 receiving packet in both switches to snifer connected to DAS-SW4 fa 0/12
configuration as below
DAS-switch1
-----
vlan 101
remote-span
monitor sess 1 source vlan 61 73 rx
monitor sess 1 destination remote vlan 101
DAS-SW4
---------
vlan 101
remote-span
DAS-SW4#monitor session 1 source vlan 61 ,73 rx
DAS-SW4(config)#monitor session 1 source vlan 61 ,73 rx
DAS-SW4(config)#monitor session 1 source remote vlan 101
% Cannot add RSPAN VLAN as source for SPAN session 1 as it is not a RSPAN Destination session
DAS-SW4(config)#monitor session 1 destination interface Fa0/12
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide