Cisco Systems WSC4500X16SFP CPU Port Sniffing

37-10
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter37 Configuring SPAN and RSPAN
CPU Port Sniffing
Configuration Scenario
This example shows how to use the commands described in this chapter t o completely configure and
unconfigure a span session. Assume that you want to monitor bidirectional traffic from source interface
Fast Ethernet 4/10, which is configured as a trunk interface carrying VLANs 1 t hrough 4094. Moreover,
you want to monitor only traffic in VLAN 57 on that trunk. Using Fast Ethernet 4/15 as your destination
interface, you would enter the following commands:
Switch(config)# monitor session 1 source interface fastethernet 4/10
Switch(config)# monitor session 1 filter vlan 57
Switch(config)# monitor session 1 destination interface fastethernet 4/15
You are now monitoring traffic from interface Fast Ethernet 4/10 that is on VLAN 57 out of interface
FastEthernet 4/15. To disable the span session enter the following command:
Switch(config)# no monitor session 1
Verifying a SPAN Configuration
This example shows how to verify the configuration of SPAN session 2:
Switch# show monitor session 2
Session 2
---------
Source Ports:
RX Only: Fa5/12
TX Only: None
Both: None
Source VLANs:
RX Only: None
TX Only: None
Both: None
Destination Ports: Fa5/45
Filter VLANs: 1-5,9
Switch#
CPU Port Sniffing
When configuring a SPAN session, you can specify the CPU (or a subset of CPU queues) as a SPAN
source. Queues may be specified either by number or by name. When such a source is specified, traffic
going to the CPU through one of the specified queues is mirrored and sent out of the SPAN destination
port in the session. This traffic includes both control packets and regular data packets that are sent to or
from the CPU (due to software forwarding).
You can mix the CPU source with either regular port sources or VLAN sources.