Multiple Probe ports, single source port, SPAN ports

[KyleWhitaker]

Ok so I am not a cisco master so lets start with that. I have an AlienVault SIEM on my network and currently I am using the span ports to send all of the switch data for our uplink port to the AlienVault SPAN port. Well, we have been tasked with getting a different SIEM and running them both in place for a little while. My question is how do I configure my span port to take one source and send it to two different destinations? I tried to create a separate session using monitor session 2 instead of monitor session 1. That did not work as the new SIEM is still not getting any traffic. Anybody have any suggestions as to what to do in this instance? 

[Deepak Kumar · Accepted solution]

Hello,

What is the switch model and firmware version? but meanwhile, you can try with as

destination {interface interface-id [, | -] [encapsulation {dot1q | replicate}]}

in this command, you can Specify a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen

[paul driver]

Hello @Deepak Kumar 

I like to convey my congratulations to you on achieving your CCIE , very well done and well deserved.

[Deepak Kumar]

Dear @paul driver 

Thank you so much.

[KyleWhitaker]

Thank you for your help Deepak. 

[paul driver]

Hello

---

@KyleWhitaker wrote:

My question is how do I configure my span port to take one source and send it to two different destinations?

You don't , You can only have specific destination(s) port per session

[Deepak Kumar]

Hello, 

I think he can as the below output is from my switch

sw10(config)#monitor session 10 destination interface gigabitEthernet 1/0/1 ?
  ,              Specify another range of interfaces
  -              Specify a range of interfaces
  encapsulation  Set encapsulation for destination interface
  ingress        Enable ingress traffic forwarding
  <cr>