1

We have a stack of 6, 48 port 3750 cisco switches and I would like to setup mirroring across the stack to send the data to a network analyser. I have done mirroring before on a single switch, but never on a stack of swtiches. My question is, what sort of things do I need to consider when trying to monitor a stack of c3750 switches with multiple vlans if I want to monitor all of the traffic on all VLANS with my network analyzer?

Since each switch is already stacked, do I only need to setup a single monitor port on one of the switches?

When I specify the port range that I want to monitor, should I just set the source port as being the various vlans I want to monitor, and then set the destination port as being a single port?

 switch 1 provision ws-c3750-48ts
 switch 2 provision ws-c3750-48ts
 switch 3 provision ws-c3750-48ts
 switch 4 provision ws-c3750-48ts
 switch 5 provision ws-c3750-48p
 switch 6 provision ws-c3750-48p

Sorry for asking multiple questions in a single post, I can break it up if needed - it just seems like all of the questions are a part of the overall question regarding configuring SPAN across a switch stack.

Improve this question
8
  • A switch stack is a single, logical device, with a single configuration, as if it were a chassis switch with multiple blades.
    – Ron Maupin ♦
    Commented Apr 18, 2016 at 17:40
  • I figured so much, just wanted to check. Regarding the configuration of mirroring multiple vlans on the stack to a single port, would the configuration be as I described it above?
    – Richie086
    Commented Apr 18, 2016 at 17:42
  • A single port on one of the switches will work, except for the fact that a single port probably can't all the traffic for that many ports, and you will probably end up dropping a lot of traffic destined for that single port.
    – Ron Maupin ♦
    Commented Apr 18, 2016 at 17:45
  • Yeah that could be an issue, but the network analyser is not mission critical for us, we just want to get a better idea of the traffic on our LAN. A few dropped packets would not be the end of the world.
    – Richie086
    Commented Apr 18, 2016 at 18:11
  • Ron, if you want to make your comment into an answer id be happy to accept it. BTW thank you for all you do for this site, I see you answer questions frequently and I always find your explanations to be of a very high quality.
    – Richie086
    Commented Apr 18, 2016 at 18:12

1 Answer 1

Reset to default
1

A switch stack basically works like a single switch with a single configuration, much like a chassis switch with multiple blades.

You would configure SPAN the same way you do on a single switch. You can set up all the traffic to go to a single monitor port on any of the switches, although you could easily overload the single port and drop a lot of traffic.

For understanding your traffic mix and quantities, NetFlow may be a better solution.

Improve this answer
2
  • Thanks Ron! I will look into Netflow instead of mirroring
    – Richie086
    Commented Apr 18, 2016 at 18:20
  • looks like netflow is not supported by the 3750s :(
    – Richie086
    Commented Apr 18, 2016 at 23:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.