Configuration Example - Cisco 4500M Software Manual

Chapter 39 Configuring SPAN and RSPAN
There are two categories of packet filtering: packet-based (good, error) or address-based
(unicast/multicast/broadcast). Packet-based filters can only be applied in the ingress direction. Packets
are classified as broadcast, multicast, or unicast by the hardware based on the destination address.
When filters of both types are configured, only packets that pass both filters are spanned. For example,
Note
if you set both "error" and "multicast," only multicast packets with errors will be spanned.
To configure packet type filtering, perform this task:
Command
Switch(config)# [no] monitor session
{ session_number } filter {vlan vlan_IDs
[, | - ] } | {packet-type {good | bad}}
| {address-type {unicast | multicast |
broadcast} [rx | tx | both]}
This example shows how to configure a session to accept only unicast packets in the ingress direction:
Switch(config)# monitor session 1 filter address-type unicast rx

Configuration Example

The following is an example of SPAN configuration using some of the SPAN enhancements.
In the example below, you configure a session to sniff unicast traffic arriving on interface Gi1/1. The
traffic is mirrored out of interface Gi1/2 with ISL encapsulation. Ingress traffic is permitted.
Switch(config)# monitor session 1 source interface gi1/1 rx
Switch(config)# monitor session 1 destination interface gi1/2 encapsulation isl ingress
Switch(config)# monitor session 1 filter address-type unicast rx
Switch(config)# exit
Switch# show monitor
Session 1
---------
Type
Source Ports
Destination Ports : Gi1/2
Filter Addr Type
OL-6696-01
: Local Session
:
RX Only : Gi1/1
Encapsulation : ISL
Ingress : Enabled
Learning : Disabled
:
RX Only : Unicast
Purpose
Specifies filter sniffing of the specified packet types in
the specified directions.
For session_number, specifies the session number
identified with this SPAN session (1 through 6).
For vlan_IDs, specifies the VLAN.
You can specify both Rx and Tx type filters, as well as
specify multiple type filters at the same time (such as
good and unicast to only sniff non-error unicast
frames). As with VLAN filters, if no type or filter is
specified, then the session will sniff all packet types.
Use the no keyword to restore the defaults.
Software Configuration Guide—Release 12.2(25)EW
Configuration Example
39-15