Cisco Catalyst 4500 series Administration Manual page 1475

Chapter 58 Configuring SPAN and RSPAN
To configure CPU source sniffing, perform this task:
Command
Switch(config)# [no] monitor session
{session_number} {source {interface
interface_list | {vlan vlan_IDs | cpu
[queue queue_ids] } [rx | tx | both]
This example shows how to configure a CPU source to sniff all packets received by the CPU:
Switch# configure terminal
Enter configuration commands, one per line.
Switch(config)# monitor session 1 source cpu rx
This example shows how to use queue names and queue number ranges for the CPU as a SPAN source:
Switch(config)# monitor session 2 source cpu queue control-packet rx
Switch(config)# monitor session 3 source cpu queue 10 rx
Note control-packet is mapped to queue 10.
OL_28731-01
Purpose
Specifies that the CPU causes traffic received by
or sent from the CPU to be copied to the
destination of the session. The queue identifier
optionally allows sniffing-only traffic (received)
on the specified CPU queue(s).
For session_number, specifies the session number
identified with this SPAN session (1 through 6).
For interface-list, specifies the source port to
monitor. Valid interfaces include physical
interfaces and port-channel logical interfaces
(port-channel port-channel-number).
For vlan_IDs, specifies the source VLAN.
For queue_ids, specifies the queue(s) involved.
(Optional) [, | -] Specifies a series or range of
interfaces. Enter a space after the comma; enter a
space before and after the hyphen.
(Optional) Specifies the direction of traffic to
monitor. If you do not specify a traffic direction,
the source interface sends both transmitted (Tx)
and received (Rx) traffic. Only received traffic
can be monitored on additional source ports.
Rx—Monitor received traffic.
•
Tx—Monitor transmitted traffic.
•
both—Monitor both received and transmitted
•
traffic (bidirectional).
Queues may be identified either by number or by
name. Queue names may subsume multiple
numbered queues for convenience.
Use the no keyword to restore the defaults.
End with CNTL/Z.
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
CPU Port Sniffing
58-11