I have cisco 2651. It contains two FastEthernet interfaces: Fa0/0, Fa0/1.Fa0/1 has an ip address. Fa0/0 hasn't an ip address.I need to create monitor session from source Fa0/1 to destination Fa0/0. Then i want to connect my notebook to Fa0/0 to analyze some traffic from port Fa0/1
View 2 RepliesWe have 2 6513 switches with SUP720/PFC3A and various POE modules and a 6748-GE-TX facing our servers. Additionally, we have a 4Gbps portchannel trunk interconnecting the switches. We have approximately 300 Nortel IP 1140e phones in use between the two switches.For the purpose of call recording, we've attempted to mirror the voice vlan using various approaches and have been met with limited success. We mirrored the VLAN using tx, rx, and both. When using both we appear to get duplicate packets at the destination interface.We seem to lose packets completely going in one direction or another for a given call. Packets are lost before they get to the destination interface?
View 2 Replies View Relatedi have just set up a monitor session with a 3750 stack .Simple enough task you would think.But i only seem to be seeing broadcast packets !!Now there is definitely unicast traffic being used on the host i am monitoring.I have done the basic commands
-monitor session 1 dest int fas 5/0/24
-monitor session 1 src int fas 5/0/34
I tried to clear monitor session on 6500 and keep on getting the following error:
%Another session parameters or permit-list is being configured %Please wait for another configuration to complete.
how i can go about clearing the monitor session.
I tried to clear monitor session on 6500 and keep on getting the following error:
%Another session parameters or permit-list is being configured %Please wait for another configuration to complete.
how i can go about clearing the monitor session.
rsbd7k01-p-vdca(config)# monitor session 2
rsbd7k01-p-vdca(config-monitor)# source vlan ?
<1-3967>
rsbd7k01-p-vdca(config-monitor)# source vlan 1 - 3967
ERROR: vlan 33-3967: Number of source vlans exceeds maximum
rsbd7k01-p-vdca(config-monitor)#
i would like to monitor traffic between multiple source ports to multiple destination ports on a nexus 7k. i lknow when you set up monitor session is between source and destination (laptop or traffic analyser) but is there a way i can set up between source and multiple destination ports and capture that traffic ?
View 3 Replies View RelatedI have a switch 4948, with version 12.2.31.sga4 ( I dont found bug about monitor session) and we try to made port mirroring with a monitor session from a VLAN and port belong at this VLAN have traffic input and output, but in the destination port, I always see it output traffic..
Global command
Red-127#sh run | in moni
monitor session 1 source vlan 1127
[Code].....
I am having difficulties with getting SPAN traffic over my WS-X6704-10GE (CFC).
CISCO7606
ios 12.2(33)SRE6, SUP720-3BXL
Trying to use the span feature, put the commands listed below in and they entered successfully, but the port is not being mirrored.
interface TenGigabitEthernet1/1
description PUBLIC
dampening
mtu 9216
ip address x.x.x.x x.x.x.x
[Code]....
I've just installed 2 of these in my workplace on a PLC network.I'm now looking to set one of the ports up as my diagnostic port and would like to be able to mirror any of the other ports to this port.I believe it is called SPAN on Cisco switches.The only reference I can find to it is configuring via Telnet which I haven't got a clue about.On my old Wiedmuller switches it was just a few clicks away.
View 3 Replies View RelatedI am trying to configure a SNORT IDS system running on a physical machine using Linux as the base OS. I have a small lab network setup with 3 VLANs, a 3548 switch and a 2611 router acting as the router on a stick/inter-vlan router. My goal is to setup SNORT as a host-based IDS system. To do that I know I need to use the "port monitor" command on the switch and I have tested this and it works fine only when the snort system and the traffic I want to monitor reside on the same VLAN.My problem is I want to be able to monitor a trunk link betwee the switch and router to see traffic coming from my 3 VLANs which contain servers. My goal is to run attacks on the servers to test SNORT's effectiveness.
Relevant information from my configuration: interface fa 0/1 on switch is the trunk like carry 3 vlans to the router On the switch:
int fa 0/1
switchport mode trunk
int fa 0/5
port monitor fa 0/1
switchport mode access
The switch will not allow me to configure fa 0/5 as a trunk, only can be an access port.So right now, SNORT does not see any traffic other than traffic from my router to the switch. I assume because this is going over the native VLAN (1 in this case) and that is the same VLAN that SNORT box resides on on interface fa 0/5. So I know the span is working to an extent, but traffic from my other VLANs (server to server traffic) does not show on SNORT at all.I have done some research on Cisco.com and see the following seemingly contradicting information:
VLAN Filtering When you monitor a trunk port as a source port, all VLANs active on the trunk are monitored by default. You can use VLAN filtering in order to limit SPAN traffic monitoring on trunk source ports to specific VLANs Then I see, under the section for the 3500 series: A monitor port cannot be a dynamic-access port or a trunk port. However, a static-access port can monitor a VLAN on a trunk, a multi-VLAN, or a dynamic-access port. The VLAN that is monitored is the one that is associated with the static-access port.
My question is, does that mean the 3548 cannot support spanning a trunk link and having all VLANs on that trunk be monitored correctly to the monitoring port? I know the 3548 is old, but it is the only thing right now I have to work with. I could put the SNORT box inline on the network, but that is another mess in itself.
Are you only able to have two sessions for port mirroring on a Cisco 4510?
View 1 Replies View Relatedis it possible to shutdown a specific port on my 3750x and monitor this port at the same time .for example , im dealing with a mac authenticated network using port security , i want to shut down all the ports that are not used at the moment , however , if some one gets connected to the one of the shutdown ports i want to know the mac address of the user or atleast to know that i have someone who is just plugged in to the one of the shutdowned ports .
View 4 Replies View RelatedI'm setting up a montitor session on a NEXUS 7K as below.we are receiving in 150M of data and 0 data going out port 9/25.but port 4/24 shows 300M to the span port?
View 1 Replies View RelatedBasically I am trying to use Wireshark to do a packet capture on a Nexus 5010. I want to do a monitor session on on the switch so I can capture from a source port to a destination port on the same switch. I can configure the source port but when I go to configure the destination port I get "ERROR: Eth102/1/4: Configuration not allowed on fex interface". I have tried to reconfigure this port as a switchport but "switchport mode access" command does not take. I don't want to make any changes to any other ports but this one.
View 1 Replies View RelatedI console into switch 1 (or router, it doesn't matter) and everything is fine. From that session I SSH to switch 2 (or router). The session on the second device has a noticable delay when I type.Next I SSH to switch 1, then SSH to switch 2 from that session. Everything works fine.Finally, I console to switch 1, and telnet to switch 2. There is no delay.So it appears the delay only occurs when I open an SSH session while consoled into a device. It didn't matter what switch 1 and switch 2 were - I had 3560Gs, 4900Ms and a 3845 router. There's no special configuration on the console or vty ports - when I do a "show line console" and "show line vty 0" the output is basically the same.
View 2 Replies View RelatedI have a 2651 that has an adsl1-wic that I am using as my DSL router. I recently acquired a 2801 that I want to replace the 2651 with. I configured the 2801 the same way as the 2651 but on a reload I get the statement that says
Setup: New interface NVIO placed in shutdown state
When I do a show interface all of the interfaces show up except the NVIO and I don't have any connectivity to the outside world. I am using Nat since I have a /29 and using nat pool overload. What am I missing? I am running IPVOICEK9-M 12.4.25c on the 2651 and adventerprise 12.4.24.T on the 2801
on 7600 SUP720 3B.I have port channel and there are two ports on that port channel. is it possible to apply this command? does it work?
View 1 Replies View RelatedI would like to ask about 3750 stacking and some Cat6 stuff...
1) How do we monitor 3750 stacking port in LMS?
2) Let say if I stack 3 switches, middle switch should be Master. Uplink should be at Top and Bottom. Is best practice?
3) Can we mixed 3750G and 3750X and what is result internal BW - fallback to 32Gps?
4) is there any Qos difference between WS-X6816-10G-2T and WS-X6816-10G-2TXL?
5) is there any Qos difference between MSFC5 PFC4 and MSFC5 PFC4XL?
6) What is main difference between PFC4 and PFC4XL in Sup2T?
7) Pls share more about Central and Distributed Switching in Sup2T and which card support Distributed DFCXL?
If I monitor a trunkport on the rootbridge in both directions I get Duplicate Multicast Packets on the perticular VLAN. The first guess is, that this is worked as designed and not a IOS Bug (Platform CAT6500 SUP720 IOS 12.2(33)SXI9 ) Until know I only found an old Cisco press link from 2002 with this subject.
View 2 Replies View RelatedI am trying to create a port channel between HP servers (4 nic) and two nexus 2k. The server side its a single team with 803.2ad fault taulerence and on the nexus side it have created two port channel (port channel 1 for nexus 2k1 and port channel 2 for nexus 2k2) and made them ACTIVE (channel group mode active)
But when i add a another server on different ports and port channel them the same way as the above server on nexus 2k1 and nexus 2k2, the first server stops pinging. so i have to sht down the first port channel and reopen them - then it works, however it says NO NETWORK ACCESS on the servers (running windows 2008). the only way is to reboot the server i cant be doing this on a production network.
I have a router on which I would like to create a port channel that spans two different Nexus 2248TP switches, and then create a couple subinterfaces on the router's po interface. I've done this successfully on my primary router, but the config doesn't seem to work on the backup router. The primary is running IOS 15, while the backup is running 12.4.25d advanced IP. I do see the trunk come up from the switch side, and my router subinterfaces and po interface show up, however I'm not able to get anywhere from the router. It's not even able to reach other hosts on the same network. As soon as I remove the port channel config and use the physical interface and assign the same address used on the port channel interface, everything works as expected and I have connectivity.
interface Port-channel21
no ip address
hold-queue 150 in
!
interface Port-channel21.248
encapsulation dot1Q 248 native
ip address 100.100.100.1 255.255.255.0
[URL]
I have a 4510R-E chassis with SUP7-E running IOS XE version 3.01.01.SG. I am unable to create a port-channel and apply auto-qos for VOIP.If I configure auto-qos on the physical interfaces, I get this message when I try adding them to the port channel:
"The attached policymap is not suitable for member either due to non-queuing actions or due to type of classmap filters."
Auto-qos is not an available command in the port-channel interface configuration, but if I try adding the service policies that were created by auto-qos to the port channel manually, it lets me apply the input policy but on the output policy I get this message:
"A service-policy with queuing actions can be attached in output direction only on physical ports."
With the input policy applied to the port-channel interface, I tried addign the output policy to the physical ports and I got this message:
"A service-policy with non-queuing actions should be attached to the port-channel associated with this physical port."
Is there a way to get the auot-qos policies applied to the port-channel properly?
i was able to configure (via SF200 web interface) a port mirroring from port FE17 to FE7.i have supressed this port mirroring.when i try to reconfigure a port mirroring from port FE17 to FE3. The SF200 web interface crash. the SF200 seems to reboot.
i have updated the SF200 firmware from V1.1.2.0 to V1.1.2.9.44 when i was able to configure (via SF200 web interface) a port mirroring from port FE17 to FE7.But after having suppressed this port mirroring again, i was not able to reconfigure a new port mirroring from port FE1 to FE3 (the SF200 hangs).
i have also tried to return to default factory setting but this does not solve the issue.i am working on SF200-24P
is ASR 1006 supported span port or port mirroring? Any config about that?
View 2 Replies View Relatedi have a question regarding the monitor session command. I have following interfaces on my router:i want to monitor the traffic from the source interface Gi0/2 to the destination interface fa1/3,monitor session 1 source interface gigabitEthernet 0/2 brings this error message % Incomplete command.,monitor session 1 source interface gigabitEthernet 0/2?/ : <0-2>,i don't have any ports on the Gigabit Interfaces. Any ideas how to monitor traffic?
View 1 Replies View RelatedI've setup and configured the following local monitor session on a 7606 but it doesnt seem to be outputing anything. Any guess as to why, or what I might be doing wrong? Gi1/1 is doing ~40Mb/s egress & 15Mb/s ingress. Both source and destination ports are routed ports.
monitor session 10 source interface Gi1/1
monitor session 10 destination interface Gi1/10 ingress
interface GigabitEthernet1/1
description WAN Link to ********************* ** CORE BACKBONE **
mtu 9000
ip address ************** 255.255.255.252
[code].....
I have a L2L tunnel setup between two ASA's (v8.4). I used the wizard to set these up and selected the defaults of both IKEv1 and IKEv2, thinking that it would select one or the other. The strange thing is that now I see a separate session between these ASA's, one for IKEv1 and one for IKEv2. Both are passing traffic. Is this expected behavior? Should I disable IKEv1 to force only v2 since both are v8.
View 5 Replies View RelatedFor the command "monitor session 1 source" in Cat4900 (e.g. 4948), how many source interfaces can be supported per monitor session?
View 1 Replies View RelatedI'm trying to create a LMS 3.2 IPM Collector, but no source devices appears in the wizard.I have the Auto Mode Enable in the Auto Allocation Settings, and in IPM Devices I can see all my devices. ¿
View 2 Replies View RelatedI have a Cisco Catalyst 3750X switch, and I have configured port mirroring on it. Traffic from 12 of the 1G ports will be mirrored to both 10G ports, and I have connected both 10G ports to a server that captures the traffic.
Currently, I have one of the 12 1G ports connected to another server that replays a pcap file once at maximum speed (i.e. option -t in tcpreplay). I thought that this setup means I should get twice the number of packets (and rate) from the two 10G ports. However, I noticed that although the original pcap file contains 4288 packets, the number of packets from the two 10G ports varies between 31000 to 34000 packets, which is about 7 to 8 times the original number of packets. Why am I getting more than twice the amount of traffic, and why does the output vary?
I have looked up the command sequence for port mirroring and it seems pretty straight forward however in my case the command will not execute.
I have a 851W with 12.4T
If I do: #monitor session 1 source interface fa 4 (wan port)
i get the response invalid input detected however if I do the same command for fa 1, fa ,2 and fa 3 they work
Using the ? shows the valid entries are [0-4] for fastethernet
I just want to monitor WAN traffic with WireShark, particularly DDNS requests, with a spare PC connected to a free lan port.
I would use a hub on the Wan connection but unfortunately I do not have one at the moment.
I have a domain server and its has 100 users. some time my users PC Net session Jam. So that time i need to delete the Net session.
View 1 Replies View Related