topic Re: SPAN in Switches, Hubs, and Modems

SPAN

Edgar Zapata — Wed, 06 Jul 2005 06:13:46 GMT

I'm trying to configure SPAN on a Catalyst 2950 to analize traffic.

Whenever I run this commands:
# no monitor session 1
# monitor session 1 source interface fastethernet0/11
# monitor session 1 destination interface fastethernet0/4
# end

I am located at port 0/4.
When I'm done with above commands, I lost connection with everything within my LAN.
Am I missing anything?

regards.

Re: SPAN

Carsten M — Thu, 07 Jul 2005 01:42:50 GMT

Hy Edgar!
This is normal
Your Port fa0/4 becomes all traffic from port fa0/11, does not send however even, therefore you lose the telnet-connection to the switch. Switch your Sniffer (network monitor) to port fa0/4 and your telnet- connection to the SWITCH to any other port.

Best regards

Re: SPAN

Edgar Zapata — Thu, 07 Jul 2005 01:50:19 GMT

Thank you much.
2 more questions.
1. I shouldn't expect to send any traffic from the PC I'm using to monitor traffic,
right?
2. Is there a way to send traffic as well from same PC?

Vielen Dank.

Re: SPAN

Regnar Bang Lyngsø_2 — Thu, 07 Jul 2005 16:38:31 GMT

2 NICs in the PC should do the trick.

Regnar

Re: SPAN

Carsten M — Fri, 08 Jul 2005 01:58:38 GMT

Hallo Edgar!
Jes first card on the monitor source Port, to send traffic and the second card on the monitor destination port.
But you only can communicate with the switch over a serial connection or your first card.

Good Luck
Carsten

Re: SPAN

Edgar Zapata — Tue, 12 Jul 2005 04:07:22 GMT

thank you guys.

Re: SPAN

Edgar Zapata — Tue, 12 Jul 2005 04:08:50 GMT

Carsten Meyer's answer helped a lot. it worked out.
thank you. regards.