Not capturing Span traffic on 3750 - need suggestions

akeyr · ‎03-28-2011

I have configured Span port on our 3750 switch port. I have a voice recording system set up on port 47, the ip pbx is attached to port 48. I am not seeing any of the port 48 traffic on port 47 as I expected. Does anyone have any suggestions ?

I added this to the config:

monitor session 1 source interface Gi1/0/48
monitor session 1 destination interface Gi1/0/47

I have attached the switch config, as well as the show mon and show int for 47 and 48

Dale Miller · ‎03-28-2011

Looking over the outputs provided it looks like SPAN is working as expected. The outputs rate on G1/0/47 matches that of the input/ouput rate on G1/0/48. Have you connected a sniffer to verify traffic is sent out the span destination port?

Session 1
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/48
Destination Ports      : Gi1/0/47
    Encapsulation      : Native
          Ingress      : Disabled

c3750.stack.aston#sh int gi1/0/48
GigabitEthernet1/0/48 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 0025.83c3.ebb0 (bia 0025.83c3.ebb0)
Description: MDF-C-77
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, media type is 10/100/1000BaseTX
Media-type configured as connector
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 123
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 381000 bits/sec, 62 packets/sec
5 minute output rate 82000 bits/sec, 56 packets/sec
     637339307 packets input, 479054571952 bytes, 0 no buffer
     Received 32955 broadcasts (77 multicasts)
     7 runts, 0 giants, 0 throttles
     7 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 77 multicast, 0 pause input
     0 input packets with dribble condition detected
     557646042 packets output, 98566018230 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out
c3750.stack.aston#sh int gi1/0/47
GigabitEthernet1/0/47 is up, line protocol is down (monitoring)
Hardware is Gigabit Ethernet, address is 0025.83c3.ebaf (bia 0025.83c3.ebaf)
Description: MDF-C-76
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
Media-type configured as connector
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 5d00h, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 455000 bits/sec, 112 packets/sec <=====
     303560474 packets input, 43603238458 bytes, 0 no buffer
     Received 105102 broadcasts (1094 multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 1094 multicast, 0 pause input
     0 input packets with dribble condition detected
     485664511 packets output, 422878049970 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out

Eugene Lau · ‎03-28-2011

G'day,

As Dale see's the SPAN as working, ensure your monitoring device is in a promiscious mode when monitoring - meaning that the NIC driver will be allowed to see all traffic.

You could test the SPAN by using a PC with WIRESHARK + WinPCAP (promiscious mode driver). They are both installed when you install WIRESHARK.

If you plug in a PC with wireshark and you see all the voice traffic -> then focus on your monitoring device.

HTH

Eugene