0

Assigning an interface as "destination" for a SPAN/mirrroring session will disrupt normal traffic forwarding on that interface.

I want to continue sending and receiving traffic on the destination interface (i.e. normal traffic forwarding).

Is that possible (I have a cisco 3560/3750 switch)? Shoud I sue the "ingress" keyword in the corrsponding cmd?

Thanks in advance.

3
  • The SPAN interface should only be used for mirrored traffic. If the device need regular communication, it should have a second interface that you connect to a different switch interface. That is how devices designed for this are configured.
    – Ron Maupin
    Aug 8 '17 at 14:56
  • @Ron: thanks for your prompt response. But it seems some switches support a "learning" keyword in the corresponding cmd (i.e. monitor session...) that allows the interface to learn MAC addresses and forward traffic normally. Is this also possible for the 3560/3750 switches (may be with some other cmd or keyword)??
    – qwa
    Aug 8 '17 at 15:07
  • Your SPAN interface is probably going to be overwhelmed with mirrored traffic, and it will be useless for normal traffic. When you purchase something like a purpose-built Sniffer, it comes with two NICs: one for the mirrored traffic, and one to communicate with the PC itself. This is the only sane way to do it.
    – Ron Maupin
    Aug 8 '17 at 15:10
1

On specific platforms (e.g. Cisco Nexus 7000 Series with NX-OS) normal pkt forwarding on a mirrored destination port is possible. But for Cisco3560/3750 series switches this cmd is not available.

The Management Configuration Guide of NX-OS, (Ch16-span configuration) says:

switchport monitor [ingress [learning]]

The "ingress" keyword allows the SPAN destination port to inject packets that disrupt a certain TCP packet stream, for example, in networks with IDS.

The "ingress learning" keyword allows the SPAN destination port to inject packets, and allows the learning of MAC addresses, for example, the IDS MAC addres

1
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Sep 8 '17 at 4:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.