Configuration Example - Cisco Catalyst 4500 Series Configuration Manual

Chapter 55 Configuring SPAN and RSPAN
The two categories of packet filtering are packet-based (good, error) or address-based
(unicast/multicast/broadcast). Packet-based filters can only be applied in the ingress direction. Packets
are classified as broadcast, multicast, or unicast by the hardware based on the destination address.
Note When filters of both types are configured, only packets that pass both filters are spanned. For example,
if you set both "error" and "multicast," only multicast packets with errors are spanned.
To configure packet type filtering, perform this task:
Command
Switch(config)# [no] monitor session
{session_number} filter {vlan vlan_IDs
[, | - ] } | {packet-type {good | bad}}
| {address-type {unicast | multicast |
broadcast} [rx | tx | both]}
This example shows how to configure a session to accept only unicast packets in the ingress direction:
Switch(config)# monitor session 1 filter address-type unicast rx

Configuration Example

The following is an example of SPAN configuration using some of the SPAN enhancements.
In this example, you configure a session to sniff unicast traffic arriving on interface Gi1/1.
Switch# configure terminal
Enter configuration commands, one per line.
Switch(config)# monitor session 1 source interface gi1/1 rx
Switch(config)# monitor session 1 destination interface gi1/2 encapsulation dot1q ingress
Switch(config)# monitor session 1 filter address-type unicast rx
Switch(config)# exit
Switch# show monitor
Session 1
---------
Type
Source Ports
Destination Ports : Gi1/2
Filter Addr Type
OL-25340-01
: Local Session
:
RX Only : Gi1/1
Encapsulation : DOT1Q
Ingress : Enabled
Learning : Disabled
:
RX Only : Unicast
Purpose
Specifies filter sniffing of the specified packet types in
the specified directions.
For session_number, specifies the session number
identified with this SPAN session (1 through 6).
For vlan_IDs, specifies the VLAN.
You can specify both Rx and Tx type filters, as well as
specify multiple type filters at the same time (such as
good and unicast to only sniff non-error unicast
frames). As with VLAN filters, if no type or filter is
specified, then the session sniffs all packet types.
Use the no keyword to restore the defaults.
End with CNTL/Z.
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
Configuration Example
55-15