cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
161
Views
1
Helpful
3
Replies

Session Monitor (SPAN) to see VMWARE data traffic on Cisco 2960

ifabrizio
Level 3
Level 3

Dear All,

 

I have tryed to setup a Session Monitor to try to capture the data traffic that camo from and to VMWARE Servers.

I set setup the monitor session on a WS-C2960L-48TQ-LL in this way:

monitor session 1 source interface Gi0/31 - 33 <----these ports are part of portchannell and are connected to VMWARE
monitor session 1 destination interface Gi0/48 <-----Here I ahve my PC with wireshark

In the wireshark I see only the broadcast traffic, do you know why?

The Portchannell is configured in this way:

interface Port-channel3
description ITTUR-ESX01 4Gb
switchport trunk native vlan 96
switchport mode trunk
switchport nonegotiate

 

and also its ports members

interface GigabitEthernet0/31
description ITTUR-ESX1_01
switchport trunk native vlan 96
switchport mode trunk
switchport nonegotiate
channel-group 3 mode on
end

 

1 Accepted Solution

Accepted Solutions

@ifabrizio 

 You need to make some changes on the ESXi side. The vswitch need to be in promiscuous mode. Check this video.

https://www.youtube.com/watch?v=rlxndbdy2zc

 

View solution in original post

3 Replies 3

@ifabrizio 

 You need to make some changes on the ESXi side. The vswitch need to be in promiscuous mode. Check this video.

https://www.youtube.com/watch?v=rlxndbdy2zc

 

amikat
Spotlight
Spotlight

Hi,

Can you please add the "encapsulation replicate" parameter when configuring the destination span port, ie:

"monitor session 1 destination interface Gi0/48 enc repl"

and check if there is any improvement.

Best regards,

Antonin

ifabrizio
Level 3
Level 3

Hi Amikat I have already tryed to add the enc repl ma nothing is changed

Review Cisco Networking for a $25 gift card