Using Discover Network Names On A Layer 3 Switch That Uses Vlans - Network Instruments GigaStor User Manual

For Cisco Catalyst 2900/3500, 4500/4000 and 5500/5000 Series Switches Running IOS 12.1 or later, encapsulation
forwarding is set as a part of the SPAN command, which has the following syntax:
monitor session session_number (source | destination)
interface type/num
To monitor 802.1Q VLAN traffic passing through Fast Ethernet 02 via a SPAN port set up on Fast Ethernet 0/6,
you would enter the following commands:
C4000 (config) # monitor session 1 source interface fastethernet 0/2
C4000 (config) # monitor session 1 destination interface
fastethernet 0/6
For a 6500/6000 Series Switch running Native IOS 12.1 or later you must configure the destination port as a trunk
port prior to configuring the SPAN, which have the following syntax:
C6500(config)#Interface Type slot/port
C6500(config-if)#Switchport
C6500(config-if)#Switchport trunk encapsulation { ISL | dot1q }
C6500(config-if)#Switchport mode trunk
C6500(config-if)#Switchport nonnegotiate
To monitor 802.1Q VLAN traffic passing through Fast Ethernet 02 via a SPAN port set up on Fast Ethernet 0/6,
you would enter the following commands:
C6500 (config) # interface fastethernet 0/6
C6500 (config-if) #switchport
C6500 (config-if) #switchport trunk encapsulation dot1q
C6500 (config-if) #switchport mode trunk
C6500 (config-if) #switchport nonnegotiate
C6500 (config-if) #exit
C6500 (config) # monitor session 1 source interface fastethernet 0/2
C6500 (config) # monitor session 1 destination interface fastethernet 0/6

Using Discover Network Names on a Layer 3 switch that uses VLANS

Symptoms: While running Discover Network Names against a Layer 3 Switch that uses VLANs, you see only a
limited number of MAC addresses, which typically have multiple IP Addresses associated with them.
Causes: Layer 3 Switches that have been configured to perform routing replace the originating station's MAC
Address with the MAC Address of the switch port. For example, suppose CADStation1 has a MAC Address of
00:00:03:AB:CD:00 and an IP Address of 10.0.0.1. It is connected to switch port 1 through a hub. Port 1 of this
switch has a MAC Address of 00:11:22:33:44:55.
When a probe is connected to a SPAN or mirror port of that switch, it shows CADStation1 with an IP of 10.0.0.1
and MAC address of 00:11:22:33:44:55 rather than 00:00:03:AB:CD:00 because of this substitution.
Now, suppose there is another station (CADStation2) with MAC address of 00:00:03:AB:EF:01 and has an IP
address of 10.0.0.2 that is also connected to port 1 of the switch through a hub. Because Discover Network
Names stores station information by MAC address (i.e., the MAC address is the unique station identifier), it
changes the IP address of switch port 1's MAC address.
Because a switch configured as such hides originating station MAC addresses from Observer, MAC-based station
statistics (such as Top Talkers-MAC, Pair Statistics matrix, etc.) can only be calculated by port. To make the
Observer displays more useful, follow this solution.
Solutions: By examining the switch configuration you can obtain a list of MAC addresses that are associated
with each port of your switch. Then, use Discover Network Names to edit the alias entry for 00:11:22:33:44:55,
labeling it "SwitchPort1."
The IP based statistical modes (Internet Observer, Top Talkers – IP (by IP Address) still show you statistics
calculated from individual stations by their IP address. But MAC-based statistical modes (Pairs Statistics Matrix,
88 | GigaStor™ (pub. 25.Apr.2014)
[encapsulation (dot1q | isl)]
encapsulation dot1Q