Span session on Cisco 5624Q

[Chad Parish]

Question, if I create a span session where my source is Fex interface, and that fex is dual homed via vPC to two 5624Q switches, is there a way to receive one capture stream to a single destination device off one of the 5k's?  Currently we have to set up two span sessions and thread the results back together in Wireshark.

[Paul Chapman · Accepted solution]

Hi -

Depending on load, you could disable 1 side temporarily to allow you to obtain your capture.  This does incur some risk, so I would suggest doing it during a maintenance window.

Alternately, it appears that wireshark can merge files for you. https://www.wireshark.org/docs/wsug_html_chunked/ChIOMergeSection.html

PSC

[Chad Parish]

Thanks Paul.  I believe you are correct, however when I disabled the fex port on one of the 5k's it also disabled the corresponding fex port on the peer 5k.  I'm looking in this.

[Paul Chapman]

Hi Chad -

That's entirely possible if you are using the config sync feature.

PSC