SPAN - drops connectivity to destination

[haggittmark@tm-america.com]

When I setup SPAN, I loose connectivity to the destination. I can’t remote into the destination computer to run Wireshark.  These are 2 switches acting in a stack.

switch(config)#do show monitor session 1
Session 1
-------------
Type : Local Session
Source Ports :
Both : gi4/0/45

Destination Ports : Gi1/0/26
Encapsulation : Native
Ingress : Disabled

[Reza Sharifi]

That is normal behavior of a SPAN destination port.

The state of the destination port is up/down by design. The interface shows the port in this state in order to make it evident that the port is currently not usable as a production port.

see link for further info:

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html#anc10

HTH

[balaji.bandi · Accepted solution]

if the port where the device connected - you enable span monitor this will be monitor port so you will loose access.

best is PC have 2 nic cards for you to remote in and monitor other connect for the span port (wireshark).

[haggittmark@tm-america.com]

Does this mean if Wireshark were already running on the destionation, Wireshark would still capture the packets even though I can not access the destination?

[Reza Sharifi]

That is correct. Wireshark will capture the packets.

HTH

[haggittmark@tm-america.com]

Thanks!

[balaji.bandi]

yes if your already running Wireshark on that port, and you have all the information capture on the destination device.