Cisco Catalyst 3560X-24P Command Reference Manual page 438

monitor session
VLAN filtering refers to analyzing network traffic on a selected set of VLANs on trunk source ports. By
default, all VLANs are monitored on trunk source ports. You can use the monitor session
session_number filter vlan vlan-id command to limit SPAN traffic on trunk source ports to only the
specified VLANs.
VLAN monitoring and VLAN filtering are mutually exclusive. If a VLAN is a source, VLAN filtering
cannot be enabled. If VLAN filtering is configured, a VLAN cannot become a source.
If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic
at Layer 2.
Destination ports can be configured to act in these ways:
•
•
•
•
Examples This example shows how to create a local SPAN session 1 to monitor both sent and received traffic on
source port 1 on stack member 1 to destination port 2 on stack member 2:
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 both
Switch(config)# monitor session 1 destination interface gigabitethernet1/0/2
This example shows how to delete a destination port from an existing local SPAN session:
Switch(config)# no monitor session 2 destination gigabitethernet1/0/2
This example shows how to limit SPAN traffic in an existing session only to specific VLANs:
Switch(config)# monitor session 1 filter vlan 100 - 110
This example shows how to configure RSPAN source session 1 to monitor multiple source interfaces and
to configure the destination RSPAN VLAN 900.
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1
Switch(config)# monitor session 1 source interface port-channel 2 tx
Switch(config)# monitor session 1 destination remote vlan 900
Switch(config)# end
This example shows how to configure an RSPAN destination session 10 in the switch receiving the
monitored traffic.
Switch(config)# monitor session 10 source remote vlan 900
Switch(config)# monitor session 10 destination interface gigabitethernet1/0/2
Catalyst 3750-X and 3560-X Switch Command Reference
2-406
When you enter monitor session session_number destination interface interface-id with no other
keywords, egress encapsulation is untagged, and ingress forwarding is not enabled.
When you enter monitor session session_number destination interface interface-id ingress, egress
encapsulation is untagged; ingress encapsulation depends on the keywords that follow—dot1q, isl,
or untagged.
When you enter monitor session session_number destination interface interface-id encapsulation
replicate with no other keywords, egress encapsulation replicates the source interface
encapsulation; ingress forwarding is not enabled. (This applies to local SPAN only; RSPAN does
not support encapsulation replication.)
When you enter monitor session session_number destination interface interface-id encapsulation
replicate ingress, egress encapsulation replicates the source interface encapsulation; ingress
encapsulation depends on the keywords that follow—dot1q, isl, or untagged. (This applies to local
SPAN only; RSPAN does not support encapsulation replication.)
Chapter 2 Catalyst 3750-X and 3560-X Switch Cisco IOS Commands
OL-21522-02