cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Join Customer Connection to register!
337
Views
0
Helpful
1
Replies
steve switzer
Beginner

SPAN on a 3750 v2 Stack

Hi All

i have just set up a monitor session with a 3750 stack .

Simple enough task you would think.

But i only seem to be seeing broadcast packets !!

Now there is definitely unicast traffic being used on the

host i am monitoring.

I have done the basic commands

monitor session 1 dest int fas 5/0/24

monitor session 1 src int fas 5/0/34

Now shouldnt this work or is there somnething i am missing ?

Steve

1 REPLY 1
Peter Paluch
Hall of Fame Cisco Employee

Hi Steve,

This SPAN configuration looks okay. However, if using Wireshark, make sure that it is configured to put your network card into promiscuous mode while capturing packets. Otherwise, your NIC will process only broadcasts and frames addressed to it. Look for "Capture all in promiscuous mode" setting in Wireshark.

Best regards,

Peter