Cisco Systems 4500 Packet Type Filtering

51-15
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 51 Configuring SPAN and RSPAN Packet Type Filtering
This example shows how to configure IP access group 10 on a SPAN session and verify that an access
list has been configured:
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# monitor session 1 source interface fa6/1 both
Switch(config)# monitor session 1 destination interface fa6/2
Switch(config)# monitor session 1 filter vlan 1
Switch(config)# monitor session 1 filter ip access-group 10
Switch(config)# exit
Switch# show monitor
Session 1
---------
Type : Local Session
Source Ports :
Both : Fa6/1
Destination Ports : Fa6/2
Encapsulation : Native
Ingress : Disabled
Learning : Disabled
Filter VLANs : 1
IP Access-group : 10
Packet Type Filtering
When configuring a SPAN session, you can specify packet filter parameters similar to VLAN filters.
When specified, the packet filters indicate types of packets that may be sniffed. If no packet filters are
specified, packets of all types may be sniffed. Different types of packet filters may be specified for
ingress and egress traffic.
The two categories of packet filtering are packet-based (good, error) or address-based
(unicast/multicast/broadcast). Packet-based filters can only be applied in the ingress direction. Packets
are classified as broadcast, multicast, or unicast by the hardware based on the destination address.
Note When filters of both types are configured, only packets that pass both filters are spanned. For example,
if you set both “error” and “multicast,” only multicast packets with errors are spanned.
To configure packet type filtering, perform this task:
Command Purpose
Switch(config)# [no] monitor session
{session_number} filter {vlan vlan_IDs
[, | - ] } | {packet-type {good | bad}}
| {address-type {unicast | multicast |
broadcast} [rx | tx | both]}
Specifies filter sniffing of the specified packet types in
the specified directions.
For session_number, specifies the session number
identified with this SPAN session (1 through 6).
For vlan_IDs, specifies the VLAN.
You can specify both Rx and Tx type filters, as well as
specify multiple type filters at the same time (such as
good and unicast to only sniff non-error unicast
frames). As with VLAN filters, if no type or filter is
specified, then the session sniffs all packet types.
Use the no keyword to restore the defaults.