Using ethereal with a SPAN port 2

[john99999]

Hi,

If I have a computer running ethereal can I just connect it to a port configured as a SPAN port on my cisco 2950 switch to view all network traffic? Will the eth card on the computer be able to pick up all network traffic just by being connected to that port?

http://www.cisco.com/en/US/products...oducts_tech_note09186a008015c612.shtml#topic5

http://ethereal.com/faq.html#q5.1

Thanks in advance,
John

 

[ADB100]

Yes, but make sure you are spanning (monitoring) the relevent ports. The 2950 can only do port monitoring and not VLAN monitoring so if all your ports are in the same VLAN you should be OK.

switch#conf t
switch#(config)monitor session 1 source interface fastethernet0/1 - 23 both
switch#(config)monitor session 1 destination interface fastethernet0/24


This will monitor ports 1-23 and push it out of port 24.

Andy

 

[john99999]

How do I disable this:
switch.urdomain.net>show monitor session 1
Session 1
---------
Type : Local Session
Source Ports:
RX Only: None
TX Only: None
Both: Fa0/1-23
Source VLANs:
RX Only: None
TX Only: None
Both: None
Source RSPAN VLAN: None
Destination Ports: Fa0/24
Encapsulation: Native
Reflector Port: None
Filter VLANs: None
Dest RSPAN VLAN: None

 

[lambent]

no mon ses 1

 

[john99999]

no mon ses 1
^

I tried that but got "error with input command at marker ^"

 

[ADB100]

You have to do it from configuration - i.e. 'conf t' and enter it as you would a global config change:

switch#conf t <CR>
switch(config)#no monitor session all <CR>
switch(config)#exit <CR>

Andy

 

[john99999]

Thanks!

conf t
is the same as
conf terminal
right?

 

[ADB100]

Yes - it should actually be 'configure terminal' but the abreviation will work - hit the ? key and see the options.

Andy