Configuration Scenario; Verifying A Span Configuration; Cpu Port Sniffing - Cisco 4500M Software Manual

CPU Port Sniffing

Configuration Scenario

This example shows how to use the commands described in this chapter to completely configure and
unconfigure a span session. Assume that you want to monitor bidirectional traffic from source interface
Fast Ethernet 4/10, which is configured as a trunk interface carrying VLANs 1 through 4094. Moreover,
you want to monitor only traffic in VLAN 57 on that trunk. Using Fast Ethernet 4/15 as your destination
interface, you would enter the following commands:
Switch(config)# monitor session 1 source interface fastethernet 4/10
Switch(config)# monitor session 1 filter vlan 57
Switch(config)# monitor session 1 destination interface fastethernet 4/15
You are now monitoring traffic from interface Fast Ethernet 4/10 that is on VLAN 57 out of interface
FastEthernet 4/15. To disable the span session enter the following command:
Switch(config)# no monitor session 1

Verifying a SPAN Configuration

This example shows how to verify the configuration of SPAN session 2:
Switch# show monitor session 2
Session 2
---------
Source Ports:
Source VLANs:
Destination Ports: Fa5/45
Filter VLANs:
Switch#
CPU Port Sniffing
When configuring a SPAN session, you can specify the CPU (or a subset of CPU queues) as a SPAN
source. Queues may be specified either by number or by name. When such a source is specified, traffic
going to the CPU through one of the specified queues is mirrored and sent out of the SPAN destination
port in the session. This traffic includes both control packets and regular data packets that are sent to or
from the CPU (due to software forwarding).
You can mix the CPU source with either regular port sources or VLAN sources.
Software Configuration Guide—Release 12.2(25)EW
39-10
RX Only: Fa5/12
TX Only: None
Both: None
RX Only: None
TX Only: None
Both: None
1-5,9
Chapter 39 Configuring SPAN and RSPAN
OL-6696-01