Skip to main content
3 votes

why it isnt possible to convert span into rspan by cabling two ports?

Switches are MAC bridges - they learn source MAC addresses and forward by destination MAC addresses. They don't work like repeater hubs. If you connect a monitor port to another (production) switch ...
Zac67's user avatar
  • 85.5k
3 votes
Accepted

How to do port mirroring in Juniper EX2200 switch

Requirements Junos OS Release 9.0 or later for EX Series switches One EX Series switch set interfaces ge-0/0/0 unit 0 family ethernet-switching set interfaces ge-0/0/1 unit 0 family inet 192.1.1.1/...
infra's user avatar
  • 3,138
3 votes
Accepted

Obtaining packet switch-port information via a mirrored port?

No. Ethernet switches are transparent devices, so they do not alter the ethernet frames (except to add and remove 802.1Q tags for trunks). There is nothing in the ethernet frame header that supports ...
Ron Maupin's user avatar
  • 99.9k
3 votes
Accepted

Netflow vs sampled netflow

For traffic analysis sampled netflow is often used, because 1:1 sampling (or non-sampled) netflow can be quite a burden on both the router sending the flow data and on the flow receiver. Most setups I'...
Teun Vink's user avatar
  • 17.4k
2 votes
Accepted

Etherchannel physical port SPAN mirror

That is what I've found: Can You Configure SPAN on an EtherChannel Port? An EtherChannel does not form if one of the ports in the bundle is a SPAN destination port. If you try to configure SPAN in ...
reybanger's user avatar
  • 305
2 votes

SPAN mirroring in cisco switch - Invalid input error

Packet Tracer has some built-in functionality to allow you to view the packets on the wire and won't support the monitor commands. However, if you weren't on tracer, the setup is straightforward. E....
HostBits's user avatar
  • 636
2 votes

Switch SPAN Port Overload

So a few points to this- SPAN is actually Cisco-specific terminology. The generic is just called port mirroring. There is huge variability in terms of the behavior of port mirroring implementations ...
rnxrx's user avatar
  • 6,124
2 votes

Capturing traffic from multiple connections on a switch

This depends largely on your switch. E.g. on HP Provision switches, the monitored ports ingress and egress traffic is copied to the mirror port. When you monitor both port A and port B, you get A->B ...
Zac67's user avatar
  • 85.5k
2 votes
Accepted

Ability to monitor all broadcast domains

By far the easiest solution is a single DHCP server (cluster) for all VLANs. Use switches or routers (helpers) to relay DHCP requests to the server and monitor all requests there. Using a hypervisor, ...
Zac67's user avatar
  • 85.5k
2 votes

How to mirror the WAN port of a Cisco 871 router?

You can't do it with Cisco 871 itself. You can try re-configure your router to receive your ISP on one of switch ports and then setup SPAN session from this port to another. (config)# monitor session ...
Andrey Prokhorov's user avatar
2 votes
Accepted

mirroring-group not possible on Aruba switch

The Aruba 2530 are rebranded HPE (Provision), yes. I'm using the "ArubaOS-Switch Management and Configuration Guide for YA/YB.16.04" pp. 272 which should be fairly easy to find at HPE. You can ...
Zac67's user avatar
  • 85.5k
2 votes

Getting Mulitple Source IP addressess when doing Port Monitoring

There could be many devices on the other side of that interface. You can use the show mac address-table interface <switchport> command to see the MAC addresses of all the devices sending frames ...
Ron Maupin's user avatar
  • 99.9k
2 votes
Accepted

Can use virtual port as the port mirroring's destination port?

Cisco created SPAN (Switch Port ANalyzer) for its switches as an aid to troubleshooting things on a network. It is designed to be enabled while troubleshooting, then disabled. Some other switch ...
Ron Maupin's user avatar
  • 99.9k
2 votes
Accepted

Mirror traffic from few interfaces in nexus 3000 switch to 2 interfaces for IPS

I'm afraid that is not possible to do this directly on the Nexus, since: only one destination port is allowed in a monitor configuration the same source port cannot be set in two different sessions. ...
JFL's user avatar
  • 19.7k
2 votes

How to Balance SPAN Traffic from Redundant Switches

You can configure a vPC EtherChannel facing the IDS in on mode (channel-group 1 mode on) as opposed to active mode. This mode doesn't require participation of the IDS to form a LAG; it doesn't need ...
Jeff Wheeler's user avatar
  • 5,502
1 vote
Accepted

Capture traffic flowing through a Brocade switch remotely

What you're looking for is called RSPAN - Remote Switch Port ANalyzer. RSPAN copies frames from a monitored port into a (dedicated) VLAN which you connect to the monitoring station. Set up a VLAN ...
Zac67's user avatar
  • 85.5k
1 vote
Accepted

Port mirroring question

Typically, if you need to use the host that is the target of a mirror, then you need a separate network connection for that. The connection used for the mirror is going to be overwhelmed with all the ...
Ron Maupin's user avatar
  • 99.9k
1 vote

Measurable performance impact of port mirroring on a firewall\security device?

You're trying to set up the IPS sniffing function on the SonicWall, mirroring LAN traffic from the switch into the SonicWall? Since both WAN traffic scanning and IPS sniffing for LAN traffic uses the ...
Zac67's user avatar
  • 85.5k
1 vote
Accepted

how to enable normal traffic forwarding on a "destination" interface in a SPAN/mirroring session

On specific platforms (e.g. Cisco Nexus 7000 Series with NX-OS) normal pkt forwarding on a mirrored destination port is possible. But for Cisco3560/3750 series switches this cmd is not available. ...
qwa's user avatar
  • 11
1 vote

Cisco Embedded Packet Capture with NAT

If your outbound interface is an ethernet interface, then you could use an ethernet switch on the outside of your router to mirror the traffic to an interface that has a monitoring device connected. ...
Ron Maupin's user avatar
  • 99.9k
1 vote

Receiving another system's network packets

Port Mirroring enabled Switch is what you would need to do this. A simple google search will give you the answer. Search for something like this "Provides network monitoring, traffic prioritization ...
Maverick's user avatar
  • 1,412
1 vote

How can I solve bandwidth problem in process of RSPAN Mirroring?

If you insist on using RSPAN to capture all traffic, but you do not want to disrupt production traffic, then you really need to set up a parallel topology for the capture VLAN to send the RSPAN ...
Ron Maupin's user avatar
  • 99.9k
1 vote

Capturing traffic from multiple connections on a switch

As tap ports do not receive but transmit only, the switch has no clue who’s sitting behind the ports. The consequence is that it broadcast the packets to all ports. Incorrect. Switches learn the ...
Ricky's user avatar
  • 32.3k
1 vote
Accepted

Virtual switch with port mirroring

You can use Open vSwitch. It has many enterprise grade features, including port mirroring. You will find on this documentation page the following information: Q: How do I configure a port as a ...
JFL's user avatar
  • 19.7k
1 vote

What requirements must general firewall/routing software meet, to make OSI 2 port mirroring work correctly?

Port mirroring is generally not a router/firewall (OSI Layer-3) function, it is a bridge/switch (OSI Layer-2) function, where all the layer-2 frames for an interface, group of interfaces, or VLAN are ...
Ron Maupin's user avatar
  • 99.9k
1 vote
Accepted

Sensor to collector communication from SPAN, Inline or TAP

The real way to do this is to configure NetFlow on your network devices (routers and switches). If you insist on using a sensor for this, you will need to use SPAN if you have a single switch, RSPAN ...
Ron Maupin's user avatar
  • 99.9k
1 vote
Accepted

How to capture from multiple mirror ports with one NIC

If you connect a repeater hub to the monitor ports you create a network loop. STP will block one port, without STP your network might go down. If the monitor ports are egress only, a switch would be a ...
Zac67's user avatar
  • 85.5k
1 vote

Is it possible to replicate RSPAN features without trunk ports?

It doesn't matter what layer-3 routing you put on your switch, SPAN and RSPAN only work at layer-2, not on layer-3 interfaces, e.g. your SVIs. The obvious solution is to change the access ports to ...
Ron Maupin's user avatar
  • 99.9k
1 vote
Accepted

How to access the Cisco Catalyst 2960 Series switch port mirroring webpage/admin interface?

You can connect to the console port of the switch to configure it. Use the provided console cable. This will connect you to the CLI interface, and this is how you will initially configure the switch. ...
Ron Maupin's user avatar
  • 99.9k

Only top scored, non community-wiki answers of a minimum length are eligible