Port mirroring through different SPAN session into single Packet Capture device

[Noovi]

Hi Guys,

i am planning to spann different ports in Darktrace application which is analysis tool.

my query is if from my switch to Darktrace tool i have 3 source interface in which i want to SPAN traffic towards Darktrace tool through 3 different destination interfaces.( 3 cables coneected to Darktrace as a destination)

Can i create 3 different SPAN session on same switch  to direct traffic into that tool as shown below.

monitor session 1 source interface Gi1/0/1
monitor session 1 destination interface Gi1/0/33

monitor session 2 source interface Gi1/0/2
monitor session 2 destination interface Gi1/0/34

monitor session 3 source interface Gi2/0/1
monitor session 3 destination interface Gi2/0/33

[balaji.bandi · Accepted solution]

Yes possible. is the source port belong to same vlan, then you can use VLAN (until you have any specific requirement)

SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports.

Note: hope source ports not particiate in Ethernet channel, if so you need to use PO as source.

[Noovi]

Hi,

yes currently listed ports are of same Vlan, but may be in future i will be taking ports from different Vlans so hence i used interface as a source inspite of Vlan.

But thanks for confirming multiple monitoring session can be mirror at a time into one destination Appliance through different destination interfaces.

i have attached diagram for more clear picture.

[balaji.bandi]

Seems to be reasonable approach, hope the information helpful, if this is resolve, make it as resolved so it will be helpfull for other community memebers.