Cisco Port Spanning Problem > All Things Tech

Posted: 4/26/2013 8:14:15 PM EDT

I am trying to span a port on a Cisco 3550 switch. Here is what I am doing

Config # monitor session 1 source interface FastEthernet 0/1
Config# monitor session 1 destination interface FastEthernet 0/22

#sh mon session 1
Session 1
---------
Type : Local Session
Source Ports :
Both : Fa0/1
Destination Ports : Fa0/22
Encapsulation : Native
Ingress : Disabled

All that I am seeing on port 22 is ARP traffic. What am I doing wrong?

Posted: 4/26/2013 8:24:12 PM EDT

[#1]

Quoted:
I am trying to span a port on a Cisco 3550 switch. Here is what I am doing

Config # monitor session 1 source interface FastEthernet 0/1
Config# monitor session 1 destination interface FastEthernet 0/22

#sh mon session 1
Session 1
---------
Type : Local Session
Source Ports :
Both : Fa0/1
Destination Ports : Fa0/22
Encapsulation : Native
Ingress : Disabled

All that I am seeing on port 22 is ARP traffic. What am I doing wrong?

Ingress: disabled - that right? I haven't had to SPAN a port in 12 years.

ETA - I can't find anything wrong. Are you sure you're actually getting traffic on 0/1?

Posted: 4/26/2013 8:29:41 PM EDT

[#2]

Quoted:

Quoted:
I am trying to span a port on a Cisco 3550 switch. Here is what I am doing

Config # monitor session 1 source interface FastEthernet 0/1
Config# monitor session 1 destination interface FastEthernet 0/22

#sh mon session 1
Session 1
---------
Type : Local Session
Source Ports :
Both : Fa0/1
Destination Ports : Fa0/22
Encapsulation : Native
Ingress : Disabled

All that I am seeing on port 22 is ARP traffic. What am I doing wrong?

Ingress: disabled - that right? I haven't had to SPAN a port in 12 years.

I believe ingress is only used for spanning vlans. I did some playing with enabling ingress and it didn't seem to make a difference.

Posted: 4/26/2013 8:31:54 PM EDT

[#3]

Your syntax looks fine.

C2950#configure terminal
C2950(config)#
C2950(config)#monitor session 1 source interface fastethernet 0/2

!--- This configures interface Fast Ethernet 0/2 as source port.

C2950(config)#monitor session 1 destination interface fastethernet 0/3

!--- This configures interface Fast Ethernet 0/3 as destination port.

C2950(config)#

C2950#show monitor session 1
Session 1
---------
Source Ports:
RX Only: None
TX Only: None
Both: Fa0/2
Destination Ports: Fa0/3
C2950#

Posted: 4/26/2013 8:32:51 PM EDT

[#4]

Only thing I can think of would be to do a sh on the interfaces for some kind of weird settings.

Posted: 4/26/2013 8:37:56 PM EDT

[#5]

That's possible. Do you see anything obviously wrong?

FastEthernet0/1 is up, line protocol is up (connected)

  Hardware is Fast Ethernet, address is 000c.8542.ff01 (bia 000c.8542.ff01)

  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 100Mb/s, media type is 10/100BaseTX

  input flow-control is off, output flow-control is unsupported

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input never, output 00:00:00, output hang never

  Last clearing of "show interface" counters never

  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  5 minute input rate 2000 bits/sec, 3 packets/sec

  5 minute output rate 9000 bits/sec, 8 packets/sec

     22652 packets input, 14194505 bytes, 0 no buffer

     Received 1395 broadcasts (0 multicasts)

     0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 watchdog, 0 multicast, 0 pause input

     0 input packets with dribble condition detected

     28273 packets output, 9523005 bytes, 0 underruns

     0 output errors, 0 collisions, 1 interface resets

     0 babbles, 0 late collision, 0 deferred

     0 lost carrier, 0 no carrier, 0 PAUSE output

     0 output buffer failures, 0 output buffers swapped out

FastEthernet0/22 is up, line protocol is down (monitoring)

  Hardware is Fast Ethernet, address is 000c.8542.ff16 (bia 000c.8542.ff16)

  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 100Mb/s, media type is 10/100BaseTX

  input flow-control is off, output flow-control is unsupported

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input never, output 00:10:29, output hang never

  Last clearing of "show interface" counters never

  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  5 minute input rate 0 bits/sec, 0 packets/sec

  5 minute output rate 14000 bits/sec, 11 packets/sec

     14 packets input, 896 bytes, 0 no buffer

     Received 14 broadcasts (0 multicasts)

     0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 watchdog, 0 multicast, 0 pause input

     0 input packets with dribble condition detected

     42038 packets output, 18833405 bytes, 0 underruns

     0 output errors, 0 collisions, 1 interface resets

     0 babbles, 0 late collision, 0 deferred

     0 lost carrier, 0 no carrier, 0 PAUSE output

     0 output buffer failures, 0 output buffers swapped out

Posted: 4/28/2013 4:00:32 AM EDT

[#6]

A few things:
1. I know the output shows native vlan, but have you tried explicitly setting it:

monitor session 1 destination interface Fa 0/22 encapsulation dot1q

2. The 2950 and 3550 can be a bastard with the duplex/speed. Try setting those and not relying on auto under the interface.
3. All your vlans exist and mapped properly?

ETA: try adding "both" to end of your first monitor session statement to tell it to capture both in/outbound traffic.

Posted: 4/28/2013 10:12:20 AM EDT

[#7]

I got it figured out. Have a look if you are interested.

http://www.ar15.com/forums/t_1_5/1476433_Cisco_Port_Spanning_Problem.html

Warning

Confirm Action

[ARCHIVED THREAD] - Cisco Port Spanning Problem

[ARCHIVED THREAD] - Cisco Port Spanning Problem