If I monitor a trunkport on the rootbridge in both directions I get Duplicate Multicast Packets on the perticular VLAN. The first guess is, that this is worked as designed and not a IOS Bug (Platform CAT6500 SUP720 IOS 12.2(33)SXI9 ) Until know I only found an old Cisco press link from 2002 with this subject.
View 2 RepliesI'm setting up a montitor session on a NEXUS 7K as below.we are receiving in 150M of data and 0 data going out port 9/25.but port 4/24 shows 300M to the span port?
View 1 Replies View Relatedi will be creating combination of SPAN and RSPAN on catalyst 6506 according to the link
[URL]
im planning to implement this on two 6506 switches will this work? or do i violate the number of monitor session? sorce span?
sw1
monitor session 1 source interface Fa5/18monitor session 1 destination interface Fa5/48
monitor session 2 source interface Fa6/34monitor session 2 destination interface
[Code].....
I have a setup where a spoke (cisco 1841) is sending a multicast feed to a hub (cisco 2951) via a DMVPN tunnel on the Internet. The feed arrives on interface fa0/0 of the cisco 1841 and is forwarded to the tunnel interface. It is about 160,000 kbit/s and 18 pps. This always looks the same:
cisco2951-1-hub#sh run int tu10
!
interface Tunnel10
description DMVPN TUNNEL
[Code]...
I have a need to capture some traffic but my core 6513's are already using the limit of 2 span sessions. I can't edit any of the sessions either because I want to source traffic from vlans and you can only do one or the other. Is using a VACL with 'switchport capture' on the destination interface an option ? E.g. I want to source traffic from vlan 10,20,30,40 and send the all to interface Gi10/10 ? Is there any caveats ? I dont need to be too granular with the ACL's but just capture all traffic in those vlans.
View 2 Replies View Relatedrsbd7k01-p-vdca(config)# monitor session 2
rsbd7k01-p-vdca(config-monitor)# source vlan ?
<1-3967>
rsbd7k01-p-vdca(config-monitor)# source vlan 1 - 3967
ERROR: vlan 33-3967: Number of source vlans exceeds maximum
rsbd7k01-p-vdca(config-monitor)#
i have a campus network with 2 core Cat6500 and multiple 4500 series distribution switches plus 2960 series access switches,we have deployed IPTV system in the network but currently 50 TVs are working through sattelite stream from streaming server Cisco's DCM 9900.we are planning to add more 300 TVs in the network and i am wondering that when all of them will be deployed then what will happen for switches cpu utilizations when all the Tvs will be running on the same time with different different channels.
View 1 Replies View RelatedOn a Catalyst 6500, we configured a SPAN session with VLAN 300 as a source. We configured the session bi-directional ("both" keyword). We connect a sniffer on the SPAN destination port.
Strangely enough, we only see the traffic from the VRF to the firewall, but not the reverse traffic ! What can be the problem ?
I am having difficulties with getting SPAN traffic over my WS-X6704-10GE (CFC).
CISCO7606
ios 12.2(33)SRE6, SUP720-3BXL
Trying to use the span feature, put the commands listed below in and they entered successfully, but the port is not being mirrored.
interface TenGigabitEthernet1/1
description PUBLIC
dampening
mtu 9216
ip address x.x.x.x x.x.x.x
[Code]....
I want to monitor our backup server (commvault) as it is saying it's library (Data Domain) is going off line.[code] The issue is I am seeing a lot of unicast traffic (on Wireshark) that has nothing to do with the server on E2/11. Some of it is from different VLANs... There is way too much data (multi-Mbps) to keep wireshark running very long to capture our intermitten problem.
View 3 Replies View RelatedI am having trouble with my Cisco SG300 switch big time. I have two servers with IP addresses 10.17.0.11 and 10.17.0.29 sitting on the same switch which is a Cisco SG300. I initiate a file transfer from 10.17.0.11 to 10.17.0.29. I could see lots of Dup Acks and retransmissions which means something is wrong in the connection. Further, I could see the session initiation a bit bizarre. I could see two SYN packets sent from 10.17.0.11 to 10.17.0.29 and also two SYN ACK packets returned by 10.17.0.29. The switch forms part of a network but since both the servers are sitting on the same switch I suppose the rest of the network doesn't come into play when one server talks to the other.
See also the number of Dup Acks and retransmissions. The two switch ports connecting the servers have speed and duplex set to auto negotiate, flow control is enabled. What could cause this sort of problem?Could it be any setting on the switch or the servers' NICs?Or could it be a bad switch that causes this?
We have IP device on the farm switch(cat6500, which is an access layer siwtch), with the gateway on the core switches (Nexus7000), on the core when I do show ip arp, I found the mac.But when I do sh mac add add of that mac there is no port attached to that mac.
Since that particular vlan only resides on the cat 6500 and two cores, so I logged in to the 6500, and when I show mac- in that vlan, I didn’t find that mac addresss. Instead, I found another mac address with last 8bit are the same of that mac.
Is it some kind VIP of the mac? How so, if no port, how can the switch forward the frame? [code]
We have 2 6513 switches with SUP720/PFC3A and various POE modules and a 6748-GE-TX facing our servers. Additionally, we have a 4Gbps portchannel trunk interconnecting the switches. We have approximately 300 Nortel IP 1140e phones in use between the two switches.For the purpose of call recording, we've attempted to mirror the voice vlan using various approaches and have been met with limited success. We mirrored the VLAN using tx, rx, and both. When using both we appear to get duplicate packets at the destination interface.We seem to lose packets completely going in one direction or another for a given call. Packets are lost before they get to the destination interface?
View 2 Replies View RelatedBeen dealing with a strange problem for several days now. It started out with a problem that I thought was VTP related but ended up being something else. I setup a span port on a 3750 that I am connected to that was mirroring the trunk connection coming into the switch.
Never saw an VTP traffic come across the connection but doing a sh vtp status indicated the traffic was arriving and getting processed. When I found some debug commands (debug sw-lan vtp), I was also able to see the packets go between switches. Seeing this issue concerns me that there is other traffic that isnt showing up during a span session.
I know that doing a span on a switch, especially using a trunk port as a source, isnt a good idea. Since I didnt have a TAP at time, this was my only choice. I have since borrowed a NetOptics TP-CU3 tap from a good friend and was able to confirm the VTP traffic was going across the trunk connection between switches.
All of my 3750's are running 12.2.55.SE.
I'm trying to configure a mirror port on a 3750. This configuration needs to replicate data from local ports, but I need that also act as a regular access port.
With the initial configuration, SPAN port, there is no problem, all the data of the configurated ports is replicating in the configurated port. On the port configurated as mirror there is a PC connected for audio recording. When the port is not operating as SPAN there is communications without problem over the LAN. But when I configure the port as SPAN, communication is interrupted.
Here is the actual configuration:
SWITCH1-PISO7#sh monitor session 1
Session 1
---------
Type : Local Session
[Code]......
i have configured SPAN over cisco 2960 to monitor source port traffic but after configuration i dont able to get response from destination port as my NMS is attached on destination port so i lost its web interface.
Configuration is as under.
monitor session 1 source interface gigabitEthernet0/5 (Source Port on Vlan 100) monitor session 1 destination interface gigabitEthernet0/1 (Destination Port on Vlan 200)
i am running c3640-is-mz.124-21.bin on a cisco router 3640. i am trying to create a monitor session in the CLI and everytime i type the command Router(config)#monitor session 1 interface ethernet2/1 % Invalid input detected at '^' marker. Router(config)#monitor session 1 interface ethernet2/1 ^% Invalid input detected at '^' marker. i get the error invalid input ?
View 10 Replies View RelatedI have two servers, connected on two(Different) 6513 directly connected switches. Both these servers are in the same Vlan.
I have to monitor communication these two servers. I have a system connected on one of the 6513 switch, where network tool wireshark is installed.
How to configure span port.
switch 6513-1# show run int Gi10/43 --------------------Server 1 is connected
switch 6513-2# show run int Gi9/45 ------------------------Server 2 is connected
switch 6513-2# show run int Gi9/46 ------------------------System on which network tool wireshark is installed.
I read quite a few documents on configuring SPAN on a cisco switch but none of them mention any limitations or any kind of CPU load it can have on a switch. I need to configure this on one of our switches and would like to know if there are any implications related to SPAN.
View 5 Replies View RelatedIn s SPAN session , normally the destination prt is used for monitoring purpose only. But could destination port be used to access the equipement or PC connected to that port , for a 2960 LAN BASE image switch .
View 2 Replies View RelatedI have created 5 new 2 Gig port channels on a 6513 WS-X6516A-GBIC blade connecting to 5 4510R+E switches. 3 of the 5 Port-channels show up/up. 2 show down/down. However, for the 2 showing down, a duplicate Po interface was created with an "A" appended to the name that shows up/up. E.g:
Port-channel26 unassigned YES unset down down
Port-channel26A unassigned YES unset up up
Each of the 4510s has a second 2Gig PO to another 6513 with an identical config and all of those come up fine.
I've run in to this on 3750G's in a various sized stacks. We apply port security for a mac address on a single port (not existing on more than one port - that's a different issue that appears in multiple posts already).In this case:
1) We do a 'sho mac address-table and see that the device with the mac address in question lives on one port, port 1/0/x.
2) We apply mac port security for this exact same mac address to the same port it is already attached to. switch(config)#int g2/0/2 switch(config-if)#switchport port-security mac-address 001a.1ec8.abcd
3) Get this error: 'Found duplicate mac-address 001a.1ec8.abcd'.We again confirm that that is the only port on the entire switch that has this mac-address.Try the command again, same error.
4) We do a bunch of show commands, get in and out of the switch, go back and then try it again, and now it works, same command, same port and same mac address.
-Aging is default 300
-These are Cisco wireless AP's attached to the switch
-This occurs on different switches with different ports using different mac addresses, always same symptoms.
Is it possible to configure the span(switch port analyzer) port and restrict it to only listen to ingress and egress of TCP/1433 from the source port?
View 2 Replies View RelatedI am having some problems creating a SPAN port on my Cisco 871 (running IOS 12.4-11T). My 871 is connected to a DSL modem, and uses "IP Negotiated" to get its dynamic ip address.I want to monitor the WAN port (FastEthernet4) using SPAN, but when I type "monitor session 1 source interface FastEthernet4" into the cli, it is rejected. I can successfully use any of the other FastEthernet ports, as well as Vlan1 as a source for the SPAN session. I have tried to use Dialer0 instead of FastEthernet4, but it still doesnt work.
View 5 Replies View RelatedI console into switch 1 (or router, it doesn't matter) and everything is fine. From that session I SSH to switch 2 (or router). The session on the second device has a noticable delay when I type.Next I SSH to switch 1, then SSH to switch 2 from that session. Everything works fine.Finally, I console to switch 1, and telnet to switch 2. There is no delay.So it appears the delay only occurs when I open an SSH session while consoled into a device. It didn't matter what switch 1 and switch 2 were - I had 3560Gs, 4900Ms and a 3845 router. There's no special configuration on the console or vty ports - when I do a "show line console" and "show line vty 0" the output is basically the same.
View 2 Replies View Relatedi have several cisco 6500 switches, and user switched connected to them.in my example i have a global service vlan, where some access ports are directly connected on the 6500, and this vlan is also allowed on the trunks to the access switch.
now i am connected with ma laptop on a access switch, where my port is in the same vlan. when i do a show mac address-table on my access port, i can see my own mac-address, nothing else.when i start wireshark to see the traffic, all i should see is traffic from or to my MAC, or broadcasts/multicasts.
But i can see other unicast traffic with different source/destination mac than mine.It seem slike these packets get broadcasted over the whole VLAN, but its no broadcast MAC nor IP.
I have cisco 2651. It contains two FastEthernet interfaces: Fa0/0, Fa0/1.Fa0/1 has an ip address. Fa0/0 hasn't an ip address.I need to create monitor session from source Fa0/1 to destination Fa0/0. Then i want to connect my notebook to Fa0/0 to analyze some traffic from port Fa0/1
View 2 Replies View RelatedI have configured SPAN session on 2960 switch, source port being a VLAN and destination being one of the fastethernet ports. All I see in the capture is control traffic (HSRP, RIP, Syslog, DNS..etc). However I dont see any real data traffic being captured. Below is how I have SPAN configured..
monitor session 1 source vlan <vlan_id> both
monitor session 1 destination interface fa0/42
how to clear vty line? Please see below. A sh tcp <line number> shows that the TCB is waiting for TCP Process. The TCP processs TCB is waiting for is SSH. I believe because of this ssh process still running, the vty line cannot be cleared.
sh users
Line User Host(s) Idle Location
1 vty 0 pf 10.10.20.8 9w1d 10.10.1.54
2 vty 1 pf 10.10.1.16 35w0d 10.10.1.54
3 vty 2 pf 10.10.1.16 1y14w 10.10.1.54
[code].....
What this crash means? This is a 6509 with a single Sup720 Cisco IOS Software, s72033_rp Software (s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXI, RELEASE SOFTWARE (fc2)System returned to ROM by s/w reset at 04:42:07 PST8PDT Mon Jan 2 2012 (SP by bus error at PC 0x40C6681C, address 0x424B).
View 1 Replies View RelatedI am planning to upgrade my cat6500 using ISSU but can not find my doc to follow yet.
View 1 Replies View RelatedUsing the new SUP-2T, need to clarify one query. If we are using the new SUP-2T in VSS mode, will the new ASA service module and NAM-3 are supported? From Cisco site, ASA module FAQ:
Q. Will the ASA Services Module support the Cisco Catalyst Virtual Switching System (VSS) at FCS?
A. Yes, depending on which supervisor you use. The ASA Services Module supports VSS either as a single firewall or as a failover pair of firewalls, when used with the Supervisor 720-10G (VS-S720-10G-3C and VS-S720-10G-3CXL). Transparent and multi- context modes also work with the VSS in this configuration. However, though the SUP 720-3B (WS-SUP720-3B and WS-SUP720-3BXL) is supported by the ASA Services Module, it is not capable of supporting the VSS. No reference to Supervisor-2T.
I wonder whethere it is possible to check the the IOS version on the standby sup720 of a 6500? if yes, what command would you use?
View 5 Replies View Related