Cisco and other mainstream switch port monitoring configuration (1)

CiscoThe port image is called SWITCHEDPORTANALYZER, or SPAN is only in the IOS system, the same below). Therefore, the port image is only applicable to Ethernet Switching ports. Cisco spans are divided into three types: SPAN, RSPAN, and VSPAN. In short, SPAN indicates that both the source and destination ports are on the same machine, and RSPAN indicates that the destination and source are not on the same switch, VSPAN can mirror the entire or several VLANs to one destination port.

CiscoCATALYST switch port image Configuration

There are two types of CISCOCATALYST switches. In the CATALYST family, listening ports are called analysis ports ).

"PortMirror" is a port image, which provides a backup channel for network transmission. It can also be used for data traffic monitoring. It can be understood as follows: Establish an image relationship between port A and port B. In this way, data transmitted through port A will be transmitted through port B at the same time, even if data error occurs at port A due to transmission line issues, data at Port B is available.

Cisco switch port image Configuration

A cisco switch supports up to two sets of images and all port images. The default password is cisco. Ciscocatylist2820 has two menu options: Enter the menu option first, and enableportmonitor enters the cli mode,

 
 

  
  
En
  
  
 
  
  
Confterm
  
  
 
  
  
Interfacefast0/x Image Port
  
  
 
  
  
Portmonitorfast0/x mirror Port
  
  
 
  
  
Exit
  
  
 
  
  
Wr
  
  
 
  
  
Ciscocatylist2924, 2948Ciscocatylist3524, 3548
  
  
 
  
  
Switch> En
  
  
 
  
  
Switch # Confterm
  
  
 
  
  
Switch (config) # Interfacefastmod/port
  
  
 
  
  
Switch (config-if) # Portmonitormod/port
  
  
 
  
  
Switch (config-if) # Exit
  
  
 
  
  
Switch (config) # Wr
  
  
 
  
  
Ciscocatylist2550Ciscocatylist3550
 
 

Two groups of monitorsessions are supported.

 
 

  
  
Enpassword
  
  
 
  
  
Configterm
  
  
 
  
  
Switch (config) # monitorsession1destinationinterfacefast0/41 is sessionid, And the id range is 1-2)
  
  
 
  
  
Switch (config) # monitorsession1sourceinterfacefast0/1, fast0/2, fast0/3 (space, comma, space)
  
  
 
  
  
Switch (config) # exit
  
  
 
  
  
Switch # copyrunning-confstartup-conf
  
  
 
  
  
Switch # showport-monitor
  
  
 
  
  
Ciscocatylist4000/5000 Series Ciscocatylist6000 Series
 
 

Two groups of images are supported.

 
 

  
  
En
  
  
 
  
  
Showmodule)
  
  
 
  
  
Setspansource (mod/port) destination (mod/port) in | out | bothinpktsenable
  
  
 
  
  
Writeternall
  
  
 
  
  
Showspan
 
 

Note: For Multiple source: mod/port, mod/port-mod/port, use the horizontal bar "-" for continuous ports, and for non-continuous ports, use the comma ","

 
 

  
  
Setspanenable allows images
  
  
 
  
  
Setspandisable: Disable Image
  
  
 
  
  
Setspansourcedestinationin | out | bothinpktsenablecreate (create is used to create a second image)
 
 

Listen to st2900xl/3500XL/2950 series switch port configuration (based on CLI)

The following are the port listening configuration commands:

Portmonitor

For example, F0/1 and F0/2 and F0/3 belong to the same VLAN1 and F0/1 Listen to ports F0/2 and F0/3:

InterfaceFastEthernet0/1

PortmonitorFastEthernet0/2

PortmonitorFastEthernet0/3

PortmonitorVLAN1

Catalyst4000, 5000, and6000 Series Switch Port image Configuration

The following are the port listening configuration commands:

Setspan

For example, in Module 1, Port 1 and Port 2 belong to the same VLAN1, Port 3 in VLAN2, port 4 and 5 in VLAN2, and Port 2 listen to ports 1, 3, 4, and 5,

Setspan1/1,1/3-51/2

Setspan

For example, in Module 6, Port 1 and Port 2 belong to the same VLAN1, Port 3 in VLAN2, port 4 and 5 in VLAN2, and Port 2 listen to ports 1, 3, 4, and 5,

Setspan6/1, 6/3-56/2

Run the following command to disable port listening:

Setspandisable [dest_mod/dest_port | all]

Cisco3550emi port image Configuration

Configure in configuration mode

 
 

  
  
monitorsession1sourceinterfaceFa0/15  
  
  
 
  
  
monitorsession1destinationinterfaceFa0/14 
 
 

Note: Port 15 is the port from the source port to the Internet), and port 14 is the computer on which the Internet management software is installed on the monitoring port.