Is there a way to overcome Cisco's 2 monitor session limitation on a VSS 6500 without the use of a network tap?
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Jan 3, 2021 at 5:36
If it's like most of the hardware switches, no. Only one "monitor session" can be active at a time, 'tho the configuration can store two.
Using vlans and external filtering hardware (gigamon?) you could have one session dumping all the traffic you want to see, but that's still one session. (and a network tap would be cheaper)
Anue Systems makes a very slick solution which allows you to pass in all your span or tap traffic and then "switch" that traffic based on your rules to your various tools that would typically utilize a span port.
I'm sure there are other vendors that provide a similar solution but I was impressed by this particular one.
Net Optics has a similar product but the interface could definitely use some improvement. May 17, 2013 at 14:05
1If we're throwing in companies to help with things like this then I think Gigamon deserve a mention. :) May 17, 2013 at 23:00
On the Cisco 6500/7600 Platform, you have two additional mirroring options that can be used along with, or to replace SPAN. The advantage of these two alternate methods is that the mirroring is performed in hardware (ASIC) so it does not impact the CPU like SPAN does. The downside to these mirroring techniques is they can only mirror inbound on the interfaces. With the smart planning of multiple source interfaces, or an entire VLAN, you can still get bidirectional traffic if necessary.
For L2 interfaces (switchports or VLANs where routing is not occuring on the switch) use VACL Capture Note that this does require a rule in the Vlan map to allow all traffic, be careful to not block traffic other than the traffic you are mirroring!
For L3 interfaces (L3 ports, SVIs, subints) use MLS IP IDS. This does not require the CBAC or firewall modules, it works on a base 6500.
If its vlan traffic look into setting up VACL captures.