1. Home
  2. Cisco Systems
  3. Catalyst port mirroring

Catalyst port mirroring

HI All,

What I'm trying to do is to have a pocket capture / traffic watcher application for network management, service usage measurements on our LAN. I'll want to know how many http, radius, ssl, smtp traffic is going on our network between my own hosts. All the equipment are connected to a catalyst 2950.

Switched networks does not allow me to watch/capture traffic on all interfaces I'll need to use some type of solution that allows me to mirror all traffic to a specific port on the switch, so I'd attach a linux box on that port and will be able to see all traffic travelling to all our routers and servers - as if they all were connected to a HUB.

I have heared about someone was counting traffic using the linux kernel ip_accounting fascility this way, but I'm not sure how to set up the switch ports for this solution.

Anyone has experience with solutions like the above?

TIA, Alex

Reply to
Alex Turtois
Loading thread data ...

Alex, What you are looking for is SPAN or monitoring on a switchport. Here is little more information on it

formatting link
If the port you want to monitor is fa0/1 and you would connect the sniffer (Ethereal or anythin like tcpdump) to fa0/15 here are the basic commands:

conf terminal monitor session 1 source interface fa0/1 monitor session 1 destination interface fa0/15

TK

Alex Turtois wrote:

Reply to
kemot

Check out Cisco Netflow. See if your switch can do it.

Reply to
zulu-1-three

if your switch doesn't support the monitor session syntax, you will need to do the following: interface FastEthernet0/x port monitor FastEthernet0/a port monitor FastEthernet0/b

fa0/x is the port your sniffer is plugged into, 0/a and 0/b would be any ports u want to sniff.

formatting link

Reply to
John Smith

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.