Catalyst 2950 SPANNING

Jul 21, 2005 5 Replies

Im strying to setup SPANNING on my switch so i can use a sniffer to see whats going on, on my network. I am currently running IOS 12.1(6)ea1.



I have done as follows to enable SPAN



monitor session 1 source interface fa0/19 monitor session 1 dstination interface fa0/18



On first attempt this stopped all traffic to my PC which is also running the sniffer. After a google it appears that the 2950 will only send and receive SPAN data on the source port (bit crap really!).



I then decided to install another NIC and tried using that for the 'monitoring NIC' (which is attached to fa0/18), and the other NIC for network access (attached to fa0/17). However, as soon as I enable the 'monitoring NIC' in windows I loose all connectivity again.



Are there any fixes to address this issue? or anyone who has worked around this?



Thanks



Gareth


No, the SMI is a Layer 2 only, the EMI is Layer 3 also.

Could it be the difference between a 2950 SI and a 2950 EI?

I have had no problems spanning on the 2950's you should add the direction to your source statement:

"monitor session 1 source interface fa0/19 both" (direction could also be either rx or tx instead)

Do a "no monitor session all" if you are still having problems and then re-enter the commands.

I am not sure what you mean by "2950 will only send and receive SPAN data on the source port (bit crap really!)." Could this be a typo?

Assuming that the speed and duplex settings match on both ports it should work with the 'both' 'rx' or 'tx' addition to the source statement.

Regards,

Martin

Well I read that once you set a destination interface, that port will only send the mirrored packets - if will not accept any other traffic from the device attached to it e.g the computer with the sniffer installed - which is why I assume I cant ping anything when I plug into that port. Duplex settings are all set to auto.

When I done a 'sh monitor session 1 detail', It stated that I was monitoring 'both' (tx and rx), but I did not specify this, was set by default - I will however try what you suggested.

what version + revision of IOS are you running? Thanks

Gareth

Just thought id let you know its now working!! very pleased! only thing i've done differantly was ptting 'both' at the end of the command. Thanks for your help :)

Gareth

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required