Difference between revisions of "Mirroring ports on Cisco switches"

From Notes_Wiki
m
m
 
Line 1: Line 1:
<yambe:breadcrumb self="Mirroring ports on Cisco switches">Switch configuration notes|Switch configuration notes</yambe:breadcrumb>
[[Main Page|Home]] > [[Switch configuration notes]] > [[Mirroring ports on Cisco switches|Mirroring ports on cisco switches (SPAN)]]
=Mirroring ports on cisco switches (SPAN) =


'''This is similar to recent article [[Configuring port mirroring or monitor session on Dell OS 10 switches]]'''
'''This is similar to recent article [[Configuring port mirroring or monitor session on Dell OS 10 switches]]'''


==Creating monitor session==
==Creating monitor session==
Line 33: Line 31:




<yambe:breadcrumb self="Mirroring ports on Cisco switches">Switch configuration notes|Switch configuration notes</yambe:breadcrumb>
 
[[Main Page|Home]] > [[Switch configuration notes]] > [[Mirroring ports on Cisco switches|Mirroring ports on cisco switches (SPAN)]]

Latest revision as of 02:40, 28 March 2022

Home > Switch configuration notes > Mirroring ports on cisco switches (SPAN)

This is similar to recent article Configuring port mirroring or monitor session on Dell OS 10 switches

Creating monitor session

To mirror ports (use SPAN) on Cisco 2950, 4503, etc. switches we can use 'monitor session' command. To create a mirror we can use

config t
    monitor session 1 source interface Gigabitethernet 1/3 both
    monitor session 1 destination interface GigabitEthernet 1/11 
    exit
wr
show monitor session 1

Here both is used to monitor both incoming and outgoing traffic. We can have multiple interfaces and VLANs and source for same destination port.

If we use show interfaces the status of monitoring interface is shown as up or down with comment monitoring in front of it. Even if the source port is trunk port the packets are passed untagged on destination interface so that we can easily capture them and analyze them. There is also some dot1q encapsulation options on some switches for monitor session destination but I have not explored that yet.

There is also something called RSPAN which can be used to monitor such that source and destination ports are on two different switches with the help of VLAN.


Deleting monitor session

To delete monitor session we can use

config t
    no monitor session 1


Home > Switch configuration notes > Mirroring ports on cisco switches (SPAN)