monitor traffic on Switch 3550

[chiuhong]

Does anyone knows how to monitor 2 ports traffic to 1 port,
as below, it seems can only monitor either rx or tx on interface Fa0/20:

monitor session 1 source interface Fa0/20 rx
monitor session 1 source interface Fa0/18
monitor session 1 destination interface Fa0/1


, Specify another range of interfaces
- Specify a range of interfaces
both Monitor received and transmitted traffic
rx Monitor received traffic only
tx Monitor transmitted traffic only

Thanks

 

[Iainh]

The switch should allow you to set 'both' on each port, which order did you enter the monitor commands in?
You could try monitoring the VLAN which would give you the same result, all be it a little less focused.

This is something you need to be VERY careful reading too much into when you get the result as no matter what you do you can get a bogus result. This is down to hardware configuration, when a packet is received on an interface which is being monitored it marks it as a packet which needs to be sent to the mirror port. The packet then goes through all the processes as it passes through the switch and then reaches the port it is going to be sent out of. At this point the switch sees the flag saying this packet needs to be mirrored and sends the packet out of both the intended interface and the one receiving the mirror traffic.

Great your sniffer sees the packet which was sent to the switch. Or maybe not then. As the packet passes through the switch things can happen to values in it, they can change, be added to, be removed completely and this is what is sent to the sniffer NOT the packet received by the interface you are monitoring.

 

[wjonline]

On the 2924's I have you have to use the SPAN commands
this allows you to monitor a port/s or vlan/s and redirect to a single port where you attach your sniffer