Reset Search
 

 

Article

Port mirroring with multiple ports

« Go Back

Information

 
TitlePort mirroring with multiple ports
Question
There are many times that a user may want to use the RSPAN feature to collect data that is sent back to an analyzer for further processing. This may be call data used for billing records, call RTP or any other packet data that could be analyzed with programs such as Wireshark. This can be used in production or testing of equipment.

Consider the use of capturing RTP packets of voice data or in the use of penetration testing, that traffic may want to be collected from several ports in order to validate that you have recorded all flows in a larger process.
Environment
Answer
The NOS SPAN feature supports collecting from multiple source ports and sending all data to one destination port. The following configuration is valid.
# sh run monitor
monitor session 1
source fortygigabitethernet 1/0/1 destination fortygigabitethernet 2/0/36 direction both
!
monitor session 2
source fortygigabitethernet 2/0/2 destination fortygigabitethernet 2/0/36 direction both
!
monitor session 3
source fortygigabitethernet 3/0/3 destination fortygigabitethernet 2/0/36 direction both
!

In this configuration you will see that the source ports can be on any Rbridge in the fabric while all destination ports are configured to the same interface.

NOTE: If the destination port becomes over run it will generate back pressure on all of the source ports which will then start discarding source RX frames.
Additional notes

Feedback

 

Was this article helpful?


   

Feedback

Please tell us how we can make this article more useful.

Characters Remaining: 255