Monitor Session not correct configured?

[Sebastian Helmer]

Hi friends,

I configured a monitor session, but my colleauge told me that he didn't see the expected traffic. It looks that he see only the normal traffic which u see on a normal access port.

please check my config if there is something wrong or known issues to the code. I'm not sure about the destination port config

Switch 65k in VSS:

sup-bootflash:s72033-ipservicesk9_wan-mz.122-33.SXH2a.bin

regards,

Sebastian

Config:

Switch#sh monitor
Session 1
---------
Type                  : Local Session
Source Ports          :
    Both              : Gi2/1/24
Destination Ports      : Gi2/2/5

Egress SPAN Replication State:
Operational mode      : Centralized
Configured mode        : Centralized (default)

Switch#sh run int gig 2/1/24

!

interface GigabitEthernet2/1/24
switchport
switchport access vlan 20
switchport mode access
no cdp enable
spanning-tree portfast
end

Switch#sh run int gig 2/2/5

!
interface GigabitEthernet2/2/5
switchport
switchport access vlan 20
switchport mode access
no cdp enable
spanning-tree portfast
end

[JohnTylerPearce]

Can you post the 'monitor session' configuration from your running config? I'll need to see that

before I can really answer your question.

[Sebastian Helmer]

Sure...

xxxxx#sh run | begin monitor

monitor session 1 source interface Gi2/1/24

monitor session 1 destination interface Gi2/2/5

[JohnTylerPearce · Accepted solution]

Well, that's basically configured so all the traffic on int Gi2/1/24 gets forwarded to Gi2/2/5. So if

you are running Wireshark you should only see traffic that is specific to Gi2/1/24 o nthe destination

port. You should see spanning tree information, other switch information cdp etc etc, unicast, broadcast,

and MC traffic as well. In other words everything that is going on traffic wise via Gi2/1/24 will be copied over

to Gi2/2/5.

[Sebastian Helmer]

thats what I tgought too...

I'll check the wireshark traces / PC from my colleauge...mabye there is something wrong..

thanks,

I inform for u and give the full rating after that ;-).!

[SunilKhanna]

I agree with john, this is a basic SPAN configuration and should see the traffic on the dest. port. From my bookmarks got this URL, thought of sha ring with you

SPAN on the Catalyst 4500/4000 and Catalyst 6500/6000 Series Switches That Run Cisco IOS System Software

Regards,

Sunil.

[Sebastian Helmer]

Dear all,

everything was right, like u confirmed!

My colleauge on the remote site use the wrong port. He use Port 6 not Port 5, so it can't ever work. On a 65k not so easy to see for a server guy .I had should check that before . But thanks to all of u.

regards,

Sebastian