9

Is there a way to overcome Cisco's 2 monitor session limitation on a VSS 6500 without the use of a network tap?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 3, 2021 at 5:36

4 Answers 4

Reset to default
8

If it's like most of the hardware switches, no. Only one "monitor session" can be active at a time, 'tho the configuration can store two.

Using vlans and external filtering hardware (gigamon?) you could have one session dumping all the traffic you want to see, but that's still one session. (and a network tap would be cheaper)

Improve this answer
6

Unfortunately no.

Anue Systems makes a very slick solution which allows you to pass in all your span or tap traffic and then "switch" that traffic based on your rules to your various tools that would typically utilize a span port.

I'm sure there are other vendors that provide a similar solution but I was impressed by this particular one.

Improve this answer
2
  • Net Optics has a similar product but the interface could definitely use some improvement.
    – Dave Noonan
    May 17, 2013 at 14:05
  • 1
    If we're throwing in companies to help with things like this then I think Gigamon deserve a mention. :)
    – David Rothera
    May 17, 2013 at 23:00
4

On the Cisco 6500/7600 Platform, you have two additional mirroring options that can be used along with, or to replace SPAN. The advantage of these two alternate methods is that the mirroring is performed in hardware (ASIC) so it does not impact the CPU like SPAN does. The downside to these mirroring techniques is they can only mirror inbound on the interfaces. With the smart planning of multiple source interfaces, or an entire VLAN, you can still get bidirectional traffic if necessary.

For L2 interfaces (switchports or VLANs where routing is not occuring on the switch) use VACL Capture Note that this does require a rule in the Vlan map to allow all traffic, be careful to not block traffic other than the traffic you are mirroring!

For L3 interfaces (L3 ports, SVIs, subints) use MLS IP IDS. This does not require the CBAC or firewall modules, it works on a base 6500.

Improve this answer
2

If its vlan traffic look into setting up VACL captures.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.