cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Join Customer Connection to register!
1425
Views
10
Helpful
3
Replies
Noovi
Beginner

Port mirroring through different SPAN session into single Packet Capture device

Hi Guys,

 

i am planning to spann different ports in Darktrace application which is analysis tool.

 

my query is if from my switch to Darktrace tool i have 3 source interface in which i want to SPAN traffic towards Darktrace tool through 3 different destination interfaces.( 3 cables coneected to Darktrace as a destination)

Can i create 3 different SPAN session on same switch  to direct traffic into that tool as shown below.

 

monitor session 1 source interface Gi1/0/1
monitor session 1 destination interface Gi1/0/33

monitor session 2 source interface Gi1/0/2
monitor session 2 destination interface Gi1/0/34

monitor session 3 source interface Gi2/0/1
monitor session 3 destination interface Gi2/0/33

1 ACCEPTED SOLUTION

Accepted Solutions
balaji.bandi
VIP Expert

Yes possible. is the source port belong to same vlan, then you can use VLAN (until you have any specific requirement)

 

SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports.

 

Note: hope source ports not particiate in Ethernet channel, if so you need to use PO as source.

 

 

 



BB


*** Rate All Helpful Responses ***

View solution in original post

3 REPLIES 3
balaji.bandi
VIP Expert

Yes possible. is the source port belong to same vlan, then you can use VLAN (until you have any specific requirement)

 

SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports.

 

Note: hope source ports not particiate in Ethernet channel, if so you need to use PO as source.

 

 

 



BB


*** Rate All Helpful Responses ***

View solution in original post

Hi,

yes currently listed ports are of same Vlan, but may be in future i will be taking ports from different Vlans so hence i used interface as a source inspite of Vlan.

 

But thanks for confirming multiple monitoring session can be mirror at a time into one destination Appliance through different destination interfaces.

 

i have attached diagram for more clear picture.

Seems to be reasonable approach, hope the information helpful, if this is resolve, make it as resolved so it will be helpfull for other community memebers.

 



BB


*** Rate All Helpful Responses ***