monitor session ?

[rico_hao40]

Hi,

Have a question about monitoring a port on 4500, command is

"monitor session 1 source interface Gi3/5

monitor session 1 destination interface Gi7/46", The sniffer is on 7/46 and monitoring server is on 3/5.

But I looked at the capture session, there are some session (unicast) even destination IP is not the server are captured ? My understanding is only source or destication IP/MAC of the server are captured on port 3/5, but why I can see other sessions?

Thanks

[royalblues]

when you configure spanning, the traffic on the port 3/5 will be mirrored onto port g7/46.

This will capture all packets/sessions that are being originated from the device connected to that port and also all broadcasts/multicasts directed to the port

Narayan

[rico_hao40]

Thanks for reply.

Yes, I think I should capture only packets/session are broadcasts/multicast or the unicast which source or destination is the server on that port, but my problem is besides above packet, I also captured lots session which are not brodcast/multicast, they are unicast and both the source or distication are not that server?

For example,

My server is 10.1.1.1/24 on port g3/5, but on that port I captured

10.20.20.1(source-61225)->10.254.2.1(des-http)

I think this session does not have any relation with server 10.1.1.1, why I can see them on port g3/5?

Strange ? Because switch should maintain a MAC -port table that only destination MAC belong to that port are forwarding

[royalblues]

This could be due to the fact that the switch is yet to learn the mac address of the destination on any port and hence is broadcasting

Typically if a switch does not know the mac address to port pinding of any frame, it will broadcast the packet out all ports except from the one received.

i dont think you will see the entite tcp stream for that session

HTH,

Narayan