Would you like to inspect the original subtitles? These are the user uploaded subtitles that are being translated:
1
00:00:00,970 --> 00:00:04,940
So that was an example of basic span.
2
00:00:04,960 --> 00:00:07,190
There are multiple options when you can figure span.
3
00:00:07,210 --> 00:00:15,100
So let's remove our current session and then specify monitor session.
4
00:00:15,320 --> 00:00:25,120
Let's create a new one of one source port is going to be interface fast Ethernet to 1 0 3.
5
00:00:25,130 --> 00:00:34,880
In this example and I'm only going to do receiving of traffic monitor session destination
6
00:00:37,850 --> 00:00:40,310
interface 1 0 5
7
00:00:44,340 --> 00:00:48,280
rather 1 0 5 and hit enter.
8
00:00:48,510 --> 00:00:58,040
Now I purposely are only creating one session with the same number to keep it simple but be aware that
9
00:00:58,040 --> 00:01:01,490
you can create multiple span sessions.
10
00:01:01,490 --> 00:01:08,450
There are some dependencies and rules with regards to span a span destination port can only be used
11
00:01:08,510 --> 00:01:16,570
with one span session at a time a span destination port can also not be a span source port.
12
00:01:16,730 --> 00:01:23,300
When you create a span destination port the switch no longer treats that port as a standard Ethan at
13
00:01:23,300 --> 00:01:24,260
port.
14
00:01:24,260 --> 00:01:30,740
As I demonstrated MAC addresses are not learned on that port and traffic received on that port is not
15
00:01:30,860 --> 00:01:32,870
accepted by default.
16
00:01:32,990 --> 00:01:41,480
You can remove a spam destination port by using the no monitor session and a number and the destination
17
00:01:41,480 --> 00:01:45,900
interface and then add it to a different monitor session.
18
00:01:45,930 --> 00:01:51,640
Some other words you can move it from one session to another multiple spans sources can be used within
19
00:01:51,650 --> 00:01:59,600
a single span session one span session cannot mix interfaces and VLAN sources so you must either look
20
00:01:59,600 --> 00:02:07,730
at multiple interfaces or multiple villains one span session can use any combination of directions so
21
00:02:07,730 --> 00:02:17,240
transmit receive or both ether channel can be used as a source port in Port monitoring or span trunks
22
00:02:17,240 --> 00:02:20,010
can also be used as source ports if required.
23
00:02:20,690 --> 00:02:28,240
So in this example we've only got a single interface but we could change that to foster Ethernet.
24
00:02:28,280 --> 00:02:35,060
1 0 3 and then specify a range of interfaces if required.
25
00:02:35,060 --> 00:02:41,040
So let's say 1 0 1 and typical Cisco fashion.
26
00:02:41,040 --> 00:02:47,720
The command is different here to other commands so I'll do receive on both those interfaces do show
27
00:02:47,720 --> 00:02:54,070
run pipe include monitor or in our example span ports.
28
00:02:54,160 --> 00:03:02,900
We're going to look at traffic received on 1 0 1 as well as 1 0 3 so I'll restart the Y shall capture
29
00:03:04,040 --> 00:03:12,710
on of 1 I'm going to send a single ping to write it to what you'll notice even though we only looking
30
00:03:12,710 --> 00:03:21,230
at receiving of traffic we captured both ping Echo as well as Echo reply so the echo would have been
31
00:03:21,230 --> 00:03:28,070
received on this port when Rata 1 transmitted traffic to write at 2 and the Echo reply would have been
32
00:03:28,070 --> 00:03:29,840
received on this port.
33
00:03:30,140 --> 00:03:38,330
So hence we received both the echo and echo reply if we had only configured this port we would only
34
00:03:38,330 --> 00:03:42,340
have received the echo and not the echo reply.
35
00:03:42,620 --> 00:03:44,430
So let's do that.
36
00:03:44,430 --> 00:03:46,730
So no monitor session 1
37
00:03:51,410 --> 00:04:00,800
we only gonna capture the traffic received on this port and then we'll send it out of port 1 0 5.
38
00:04:00,800 --> 00:04:11,270
So now when I clear the session and do a ping notice we only receive half the traffic so be careful
39
00:04:11,270 --> 00:04:14,300
which ports are the source of your capture.
40
00:04:14,390 --> 00:04:19,730
And be careful of the direction of traffic both will allow you to capture traffic in and out of that
41
00:04:19,730 --> 00:04:27,630
port receive is only traffic received on that port transmit is traffic sent out of that port you could
42
00:04:27,630 --> 00:04:40,890
as an example capture on the V Lan So let's get rid of session 1 and what I'll do is say v lan 1 received
43
00:04:40,920 --> 00:04:48,450
traffic and the destination will be port 5 I'll clear the Y shore capture
44
00:04:51,420 --> 00:04:59,300
and do a single ping again and notice here we see both the echo and echo reply message so this echo
45
00:04:59,310 --> 00:05:11,500
reply has echo request because this port and this port on VLAN 1 this port 1 0 2 is actually shut down
46
00:05:11,500 --> 00:05:20,790
in this topology so we could delete that port from the topology some show commands again show monitor
47
00:05:21,600 --> 00:05:29,520
we can see that we've got one session enabled it's a local session we receiving traffic on VLAN 1 destination
48
00:05:29,520 --> 00:05:37,710
port is 1 0 5 we're using a native encapsulation and ingress is disabled so traffic will be dropped
49
00:05:38,310 --> 00:05:49,100
that's received on this port we can also look at detailed information so it's a local session.
50
00:05:49,210 --> 00:05:51,830
They are no source ports configured.
51
00:05:51,890 --> 00:06:00,510
We only have a source a villain configured and we capturing traffic received on VLAN 1 not transmitted
52
00:06:00,600 --> 00:06:02,170
on VLAN 1.
53
00:06:02,190 --> 00:06:04,770
A remote spend session is not configured.
54
00:06:04,980 --> 00:06:15,200
The destination port for the span session is 1 0 5 of the options are not configured so let's have a
55
00:06:15,200 --> 00:06:17,320
look at some of the options.
56
00:06:17,330 --> 00:06:28,590
Show monitor session all at the moment no spend configuration is present on the system we can look at
57
00:06:28,600 --> 00:06:37,020
local span we can even look at remote span remote Spanish used where you have a different source and
58
00:06:37,020 --> 00:06:44,070
destination switch so the source port could be this port on switch to and the destination could be this
59
00:06:44,070 --> 00:06:53,760
port on switch 1 So traffic will be captured on this port and sent to the capturing device on this switch
60
00:06:53,940 --> 00:07:04,720
switch one so I'll configure a monitor session to monitor session pick a number like one source interface
61
00:07:05,480 --> 00:07:11,340
fast ethernet 1 0 1 the destination.
62
00:07:11,340 --> 00:07:22,630
In our example is going to be 1 0 5 seduce show run pipe include monitor that's what we've done.
63
00:07:22,860 --> 00:07:34,730
If we tried to configure another session using the same destination port of interface if 1 0 5 notice
64
00:07:34,730 --> 00:07:41,990
we told that to that port is already being used so we configured this port as the destination of session
65
00:07:41,990 --> 00:07:50,510
1 we can't now configure it to be the destination for session 2 but we could as an example configure
66
00:07:50,510 --> 00:07:54,630
session 2 and specify a different source.
67
00:07:54,710 --> 00:08:08,230
So 1 0 1 as an example so do show run pop include monitor we've got two sources configured but only
68
00:08:08,230 --> 00:08:20,340
one destination so show monitor session or we've got session 1 configured and Session 2 configured but
69
00:08:20,340 --> 00:08:28,200
only session 1 is configured with a destination port Session 2 is not currently being used on one shock
70
00:08:28,230 --> 00:08:34,980
device we should be able to capture traffic from Rado want to write it to which we can see unit cost
71
00:08:35,010 --> 00:08:41,900
traffic sent from right I want to write it to it's being forwarded out of this port because of this
72
00:08:41,900 --> 00:08:53,230
monitoring session traffic sent and received on f 1 slash 1 is going to be sent out of 1 0 5 and hence
73
00:08:53,230 --> 00:08:58,480
we see the ICMP echo request and echo reply messages
74
00:09:02,330 --> 00:09:09,140
now there's nothing stopping us moving the destination port from one session to another so we could
75
00:09:09,620 --> 00:09:17,880
put a no in front of that command will now move it to Session 2 so that's accepted.
76
00:09:18,120 --> 00:09:26,300
So what we've done now is move the destination port from session one to session to all clear that why
77
00:09:26,300 --> 00:09:35,980
shock capture do the ping again and they're just we capturing the traffic because we capturing some
78
00:09:35,980 --> 00:09:38,460
laconic traffic but in a different session.
9153
Can't find what you're looking for?
Get subtitles in any language from opensubtitles.com, and translate them here.