Hot answers tagged

9

There are a couple of options, depending on how much traffic you will receive: If you're going to receive a lot of traffic, should use gulp, which runs on linux; gulp requires the linux pf_ring kernel module. If the bandwidth requirements are reasonable, you could simply use your laptop with wireshark's ERSPAN decoder; wireshark can see the protocols inside ...


7

Typically, according to Cisco, "The impact on the high-speed switching fabric is negligible". This of course depends on your switch, its fabric and the load on the switch itself. The port that is being sent the copied data could drop packets however, if it's oversubscribed too heavily. Personally, I've never experienced any sort of detriment by using ...


6

A back-to-back SPAN session would seem to work. I can't say that is what was used in your environment but I just labbed it up and it worked with no problems. I was able to capture packets on the laptop that were from the gi0/7 interface on the 2960G. A poor mans RSPAN. Test layout and configurations below. No special configuration on the switchports at all, ...


5

what impact could this SPAN operation cost me on performance ? If you are referring to a possible performance penalty on your firewalls ability to process packets, then there shouldn't be any for this simple of an operation. The only time that would come into play is if you begin setting up multiple filters to inspect packet headers in real-time on multiple ...


4

I'm pretty sure you can't SPAN on any ASA except 5505 since it has a real switch.


4

Because RSPAN is "Remote Span" right? SPAN is just local on the same switch. With RSAPN You need to configure a vlan because you are 'mirroring' a remote port on a remote switch. In order to pass this traffic to the destination port, on a remote switch, you need to configure a vlan for this purpose.


3

For traffic analysis sampled netflow is often used, because 1:1 sampling (or non-sampled) netflow can be quite a burden on both the router sending the flow data and on the flow receiver. Most setups I've seen use a sampling rate varying from 1:100 upto 1:4000 (depending on the size of the network and the amount of traffic pushed), and they're perfectly able ...


3

It is possible to affect the sources (i.e. monitored ports) if the aggregate traffic exceeds the capability of the destination (i.e the monitoring port). I don't have the reference I was initially thinking of, but here's another: Back pressure from a SPAN port. So imagine you have server on a ten-gig port that you want to SPAN to a packet capture device (...


3

The documentation says: "NOTE: If a port is configured as a mirror port, all traffic sent from that port will retain the encapsulation of the port being monitored and not add the encapsulation of the Egress port.". So it's a 1:1 packet copy, any tagging is preserved.


3

No. Ethernet switches are transparent devices, so they do not alter the ethernet frames (except to add and remove 802.1Q tags for trunks). There is nothing in the ethernet frame header that supports what you ask, and a switch does not add anything, making it look like the source host is directly communicating with the destination host on a dedicated link. ...


3

Requirements Junos OS Release 9.0 or later for EX Series switches One EX Series switch set interfaces ge-0/0/0 unit 0 family ethernet-switching set interfaces ge-0/0/1 unit 0 family inet 192.1.1.1/24 set interfaces ge-0/0/10 unit 0 family ethernet-switching set ethernet-switching-options analyzer employee-monitor input ingress interface ge-0/0/0.0 set ...


3

Switches are MAC bridges - they learn source MAC addresses and forward by destination MAC addresses. They don't work like repeater hubs. If you connect a monitor port to another (production) switch it'll learn all mirrored frames' source MACs on its ingress port, messing up its source address table. Subsequently, it'll forward frames destined for the ...


2

As far as I know you cannot do anything to increase the amount of SPANs (monitor-sessions) you can perform simultaneously on a Catalyst6509. When we previously ran into this problem, we started using VACLs instead and sending the traffic to capture ports.


2

That is what I've found: Can You Configure SPAN on an EtherChannel Port? An EtherChannel does not form if one of the ports in the bundle is a SPAN destination port. If you try to configure SPAN in this situation, the switch tells you: Channel port cannot be a Monitor Destination Port Failed to configure span feature You can use a ...


2

Route? NO. Encapsulate and send as a stream somewhere else (aka RSPAN)? Yes. (or maybe) Also, all you can do with that traffic is look at it. You cannot pretend to be part of the conversation.


2

You want what Cisco calls rspan. Someone put together a comparison of the ways to do this with comware, cisco, and provision: here (switch with traffic of interest) [Comware5]mirroring-group 1 remote-source [Comware5]vlan 960 [Comware5]mirroring-group 1 remote-probe vlan 960 [Comware5]mirroring-group 1 mirroring-port g1/0/18 both [Comware5]mirroring-group 1 ...


2

There is no privilege level which specifically allows users to change only monitor port. You need to make a view (Role-Based CLI Access) which only allows a specific command, and assign it to the privileges: SUMMARY STEPS enable view configure terminal parser view view-name [inclusive] secret [0 | 5] encrypted-password commands parser-...


2

Packet Tracer has some built-in functionality to allow you to view the packets on the wire and won't support the monitor commands. However, if you weren't on tracer, the setup is straightforward. E.g. monitor session 1 monitor session 1 source int gi1/0/2 both (-- specifies span tx and rx monitor sessions 1 destination int gi1/0/3


2

So a few points to this- SPAN is actually Cisco-specific terminology. The generic is just called port mirroring. There is huge variability in terms of the behavior of port mirroring implementations across different hardware. As an example - in a surprising number of platforms (across different vendors) oversubscribing the amount of traffic being mirrored ...


2

I'm afraid that is not possible to do this directly on the Nexus, since: only one destination port is allowed in a monitor configuration the same source port cannot be set in two different sessions. the destination port of a session cannot be set as the source port of another session. Some IOS based switches allow this configuration (with 2 destination ...


2

You can't do it with Cisco 871 itself. You can try re-configure your router to receive your ISP on one of switch ports and then setup SPAN session from this port to another. (config)# monitor session 1 source interface fa3 both (config)# monitor session 1 destination interface fa0


2

This depends largely on your switch. E.g. on HP Provision switches, the monitored ports ingress and egress traffic is copied to the mirror port. When you monitor both port A and port B, you get A->B or vice versa flows twice on the mirror port with some devices and just once on others. I'm not sure about broadcasts, but you're likely to get a copy from each ...


2

By far the easiest solution is a single DHCP server (cluster) for all VLANs. Use switches or routers (helpers) to relay DHCP requests to the server and monitor all requests there. Using a hypervisor, you could also use a single machine attached to every VLAN using a dedicated vNIC for each. Depending on the hypervisor you could alternatively set up a port ...


2

There could be many devices on the other side of that interface. You can use the show mac address-table interface <switchport> command to see the MAC addresses of all the devices sending frames into the switch on that interface. For example, you could have a hub, switch, or WAP connected to that interface, and you will see all the MAC addresses of the ...


2

The Aruba 2530 are rebranded HPE (Provision), yes. I'm using the "ArubaOS-Switch Management and Configuration Guide for YA/YB.16.04" pp. 272 which should be fairly easy to find at HPE. You can configure up to four mirror "sessions". Basically, you assign an egress interfaces to a session mirror 1 - 4 port exit-port-# [name name-str] and then assign each ...


2

Cisco created SPAN (Switch Port ANalyzer) for its switches as an aid to troubleshooting things on a network. It is designed to be enabled while troubleshooting, then disabled. Some other switch vendors do something similar, and others do not. Even with a particular vendor, some models may be able to do it, and some not, and it may be differently configured ...


1

Port mirroring is generally not a router/firewall (OSI Layer-3) function, it is a bridge/switch (OSI Layer-2) function, where all the layer-2 frames for an interface, group of interfaces, or VLAN are also sent to a designated bridge/switch mirror interface. The host on the bridge/switch mirror interface receiving the frames must have its interface configured ...


1

The real way to do this is to configure NetFlow on your network devices (routers and switches). If you insist on using a sensor for this, you will need to use SPAN if you have a single switch, RSPAN for multiple switches connected by layer-2, or ERSPAN for layer-3 separated switches.


1

If you connect a repeater hub to the monitor ports you create a network loop. STP will block one port, without STP your network might go down. If the monitor ports are egress only, a switch would be a better solution (see 3.) as it could keep up with the data rate much better. Roughly, there are four solutions: As Ron has pointed out, RSPAN or similar ...


1

On specific platforms (e.g. Cisco Nexus 7000 Series with NX-OS) normal pkt forwarding on a mirrored destination port is possible. But for Cisco3560/3750 series switches this cmd is not available. The Management Configuration Guide of NX-OS, (Ch16-span configuration) says: switchport monitor [ingress [learning]] The "ingress" keyword allows the SPAN ...


Only top voted, non community-wiki answers of a minimum length are eligible