SPAN port on Cat 4006

Apr 04, 2008 3 Replies

Hi Group,



I am trying to setup a SPAN port on a Cisco Cat 4006 running CATOS, however when I establish the SPAN port it shuts of the interface so I can no longer ping the device. Is this normal behavior or am I missing something?



(enable) sh ver WS-C4006 Software, Version NmpSW: 7.4(2) Copyright (c) 1995-2002 by Cisco Systems, Inc. NMP S/W compiled on Oct 8 2002, 18:12:59 GSP S/W compiled on Oct 08 2002, 15:54:51



System Bootstrap Version: 5.4(1)



Hardware Version: 3.2 Model: WS-C4006 Serial #: FOX0610031N



Mod Port Model Serial # Versions



--- ---- ------------------ --------------------



---------------------------------



1 2 WS-X4013 JAE06140184 Hw : 3.2 Gsp: 7.4(2.0) Nmp: 7.4(2)
2 48 WS-X4148-RJ45V JAE0638073Q Hw : 2.6
3 48 WS-X4148-RJ45V JAE065005NG Hw : 3.0
4 48 WS-X4148-RJ45V JAE0638073R Hw : 2.6
5 48 WS-X4148-RJ45V JAE06240BFV Hw : 2.7
6 48 WS-X4148-RJ45V JAE061105E6 Hw : 3.0

DRAM FLASH NVRAM Module Total Used Free Total Used Free Total Used Free



------ ------- ------- ------- ------- ------- ------- ----- ----- -----



1 65536K 40025K 25511K 16384K 7803K 8581K 480K 351K 129K

Uptime is 61 days, 17 hours, 19 minutes (enable)


Like disables the source port? Please paste the config line and show span commands.

Trendkill wrote: > Like disables the source port? Please paste the config line and show

Hi Trendkill,

What I am trying to do, is have a host sniff all traffic on a common VLAN, all hosts are on VLAN 1.

So I enter;

set span 1 2/47 Overwrote Port 2/47 to monitor transmit/receive traffic of VLAN 1 Incoming Packets disabled. Learning enabled. (enable)

So the port is now listening but it disables incoming packets so I can not remotely connect to the host sniffing the network. Would I just be better off adding a 2nd NIC card and be down with it?

(enable) sh span

Destination : Port 2/47 Admin Source : VLAN 1 Oper Source : Port 2/1-12,2/14-29,2/31-38,2/43-46,2/48,3/19,3/47 Direction : transmit/receive Incoming Packets: disabled Learning : enabled Filter : - Status : active

------------------------------------------------------------------------ Total local span sessions: 1 (enable)

#switch port analyzer set span 1 2/47 both inpkts disable learning enable create

Thanks for the help...

Chad

Yes, thats normal SPAN behavior. You don't want remote access packets being mixed in with your monitored port data do you???

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required