Something like: mirror 1 port a1 # configure traffic class - what to match on class ipv4 "all-traffic" 10 match ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 exit Now, the SPAN profile is up, and life is good. You should not issue the monitor session 1 source vlan 4, 10 - 12, 15command. Crudely, you could monitor all ports in those VLANs to a single mirror session. There may only be one destination port in a monitoring session. Thanks! Similarly, you should not issue the monitor session 1 destination vlan 4, 10 - 12, 15 command. Remote Switched Port Analyzer (RSPAN) Configure Port Monitor Session Verify Port Monitor Session Force10#show monitor session 0 To configure an alphanumeric name for a mirroring session, see . To use ERSPAN to monitor traffic through one or more ports or VLANs in same device, we must have to create an ERSPAN source and ERSPAN destination sessions in same device, data flow takes place inside the router, which is similar to that in local SPAN. You could also use classifiers and "match any" on all the VLANs you want to monitor. Source VLAN is a VLAN whose traffic is monitored with the use of the SPAN feature. It can be monitored in multiple SPAN sessions. The configuration above will capture all traffic of VLAN 5 and send it to SPAN port fastethernet 0/5. Plug a patch cable into the destination . In a single local SPAN session or RSPAN source session, you can monitor source port traffic, such as received (Rx), transmitted (Tx), or bidirectional (both). the ERSPAN spans traffic from source ports across multiple switches to the destination switch, where a network analyzer is connected. To create a SPAN source session to monitor the traffic that is bridged into a source VLAN, use the monitor session session_number source vlan vlan-id command. Overview When using VLAN as the source on port monitoring you will have to configure flow-base monitoring to pass traffic to the destination port. RE: monitor session 1 source vlan 10. vipergg (MIS) 19 Jan 06 16:54. The switch supports any number of source ports (up to the maximum number of available ports on the switch) and any number of source VLANs. The SPAN or RSPAN source interface in VSPAN is a VLAN ID, and traffic is monitored on all the ports for that VLAN. CODE EXAMPLE 9-1 Setting Up a Port Mirroring Session. Cisco Catalyst switches can forward traffic on a destination SPAN port in Cisco IOS 12.1(13)EA1 and later . You can have multiple RSPAN sessions but only one ERSPAN session. Please see my example below: lab1 (config)#monitor session 1 source vlan 2 , 4 , 6 , 8 , 10 lab1 (config)#monitor session 1 source vlan 12 , 14 , 16 , 18 , 20 lab1 (config)#do show run | i monitor monitor session 1 source vlan 2 , 4 , 6 , 8 , 10 #monitor session 5 source remote vlan 999 Switch2(config)#monitor session 5 destination interface Gi0/3 Un aspecto importante, que debemos tener en cuenta al plantearnos cmo configurar SPAN, RSAPN y ERSPAN, es el modelo del enrutador. There is also an option to filter VLANS under the monitor session using the filter vlan vlan-id command. You cannot mix source VLANs and filter VLANs within a single SPAN session. Reflector Port is a port that copies packets onto an RSPAN VLAN. This preview shows page 82 - 84 out of 365 pages. Which command flags an error if it is added to this configuration? A Port monitoring session can have multiple source statements. Configuration Source Interface Configuration Example - Monitoring an entire VLAN traffic. Therefore, you cannot have two SPAN sessions that use the same . On the source switch, specify the destination as the RSPAN VLAN: switch-1 (config)#monitor session 11 destination remote vlan 777 You can enter a destination VLAN that has not been configured as an RSPAN VLAN, but, alas, it won't work. SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports. This is a span session used for either collecting . Monitor session 1 source vlan multiple . config span port to monitor multiple vlans on 3750G switch hi all, Please help to config this feature on Cisco switch 3750G. These switches cannot monitor VLAN source. In a single local SPAN session or RSPAN source session, you can monitor source port traffic, such as received (Rx), transmitted (Tx), or bidirectional (both). Si este tiene algunos aos, es posible que nos pida configurar el . This process is known as port-based mirroring and is typically used for external analysis and capture. A source port has these characteristics: To create a SPAN source session to monitor the traffic that is bridged into a source VLAN, use the monitor session session_number source vlan vlan-id command. [name name-str]: Optional; configures the selected port traffic to be mirrored in the specified session name. A source port has these characteristics: VSPAN has these characteristics: All active ports in the source VLAN are included as source ports and can be monitored in either or both directions. A session can have up to eight source ports and one destination port with the same session number. Microbyte. Using remote SPAN (RSPAN) or encapsulated RSPAN (ERSPAN) allows you to send the collected packets across layer-2 domains for analysis. In the following example, we configure a SPAN session so that a monitoring tool connected on port 10 gets a copy of all traffic going in and out of VLANs 1 and 100. (DTI SWITCH) #config (DTI SWITCH) (Config)# monitor session 1 mode (DTI SWITCH) (Config)#monitor session 1 source interface 0/7 ? <cr> Press Enter to execute the command. VLAN-based SPAN (VSPAN) is the monitoring of the network traffic in one or more VLANs. If you don't want to use an interface as the source but a VLAN, you can do it like this: Switch (config)#monitor session 2 source vlan 1 Switch (config)#monitor session 2 destination interface fa0/3 monitor session 1 source vlan 10 and monitor session 1 destination analysis-module 9 data-port 1 Somebody help? You are allowed to use a VLAN interface as the source port in a regular port monitor setup. I have tried basically all the variations of the commands I can come up with, but I just do not see the expected traffic. But, you will not receive any packets to the destination port. It cannot be a destination port (that's where the packet analyser connects to) Each source port can be configured with a direction (ingress, egress, or both) to monitor. Use the command show monitor session 1 to verify your . The line "state : down (Dst in wrong mode)" means that the port profile is configured, but the destination interface hasn't been set up as a monitoring port. . The switch supports any number of source ports (up to the maximum number of available ports on the switch) and any number of source VLANs. rx Monitor ingress packets only. tx Monitor egress packets only. RSPAN: RSPAN has all the features of SPAN, plus support for source ports and destination ports that are distributed across multiple switches, allowing one . 1 - 4: Configures the selected VLAN traffic to be mirrored in the specified session number. Switch (config)#monitor session 1 filter vlan 1 - 100 This filter above will only forward VLAN 1 - 100 to the destination. The following factors are applicable while using ERSPAN as a local SPAN: Only one destination port is allowed per SPAN session and the same port cannot be a destination port for multiple SPAN sessions. These commands have been added to the configuration of a switch. You can accomplish this with multiple "monitor session 1 source vlan" config lines. . c3750 (config)# monitor session 1 source vlan 5. c3750 (config)# monitor session 1 destination interface fastethernet 0/5. One Destination Port can be used in multiple sessions. Now, on the destination switch, configure the same VLAN as an RSPAN VLAN. A source port cannot be a destination port. I have the following config but for one vlan only : switch (config)# monitor session 1 source vlan 5 switch (config)# monitor session 1 destination interface fastethernet 0/3 What it means any traffic that is in vlan 10 is being spanned to your nam module in slot 9 . However, most switches support many-on-one port mirroring. This means that you can choose multiple gateways or VPNs as the source. Wireshark does not capture egress packets when egress span is active. The monitor session sourcecommand is used to configure a source interface or VLAN but not a range of VLANs. Destination port is a port that monitors source ports, usually where a network analyzer is connected. # monitor session 10 type erspan-source N6k-1(config-erspan-src)# erspan-id 20 N6k-1(config-erspan . A monitoring port also may not be a member of a VLAN. A. monitor session 1 source interface port-channel 6 B. monitor session 1 source vlan 10 C. monitor session 1 source interface FastEthemet0/1 rx D. monitor session 1 source interface port-channel 7, port-channel 8 The string can be used interchangeably with the session number when using this command to assign a mirroring source to a session. Beginning in privileged EXEC mode, follow these steps to limit SPAN source traffic to specific VLANs: To monitor all VLANs on the trunk port, use the no monitor session session _number filter To monitor all VLANs on the trunk port, use the no monitor session session _number filter global configuration command. A local SPAN session is an association of a destination port with source ports or source VLANs, all on a single network device. Note: VLAN interfaces may be configured as a source for monitor sessions, but configured monitor sessions are limited to no more than 1 source VLAN across all configured monitoring sessions. monitor session 1 source interface G1/0/1 monitor session 1 destination interface G1/0/42 With the 9300 switches when I attempt to capture I am only seeing one side of the traffic. A source port cannot be a destination port. monitor session <number> filter vlan <vlan-range> Remote Span Enables the traffic analyzer to be located in a different part of the campus network to the source device Uses a special VLAN marked for Remote SPAN use If the source and destination switches are not directly connected, each switch along the path must know of the RSPAN VLAN Traffic monitoring in a SPAN session has the following restrictions: Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same session. For EtherChannel sources, the monitored direction applies to all physical ports in the group. The main thing to watch out for is the use of spaces. A session can have up to eight source ports and one destination port with the same session number. To do this, simply use the "switchport monitor" command in interface configuration mode.