SPAN configuration on 2950 switch

[RickLopez2]

Hi,

I am trying to configure SPAN on a 2950 switch for the first time but Ethereal doesn't capture any information other than spanning tree information. When I do a show monitor I get the following:

vlab-2950#show monitor
Session 1
---------
Source Ports:
RX Only: None
TX Only: None
Both: Fa0/1-23,Gi0/1-2
Destination Ports: Fa0/24

or from a show-running-config I get:

monitor session 1 source interface Fa0/1 - 23 , Gi0/1 - 2
monitor session 1 destination interface Fa0/24

My PC running Ethereal is plugged into port 24. Are there any other Cisco settings that can affect the SPAN configuration? Thanks.

 

[vipergg]

Looks right , as long as port 24 is not shutdown .
I would make sure portfast is on for port 24 but besides that I would cast on eye on Ethereal . You should be something even if the span wasn't set as you see broadcasts etc .. from workstations .

 

[RickLopez2]

Thanks for the reply. I installed Ethereal on another PC as a test with the same results. If I turn off SPAN on port 24 the port then works normally. In looking at the interface in more detail I see;

vlab-2950#show interfaces fastEthernet 0/24 status

Port Name Status Vlan Duplex Speed Type
Fa0/24 monitoring 1 a-full a-100 10/100BaseTX


vlab-2950#show interfaces fastEthernet 0/24 switchport
Name: Fa0/24
Switchport: Enabled
Administrative Mode: static access
Operational Mode: down
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001

Protected: false

I noticed that the operational mode is "down" but is this because it is the destination port for SPAN? I've also noticed that for this port it shows "switchport mode access" in the running-config file while it doesn't show for the other ports?

interface FastEthernet0/23
no ip address
no cdp enable
spanning-tree portfast
--More--  !
interface FastEthernet0/24
switchport mode access
no ip address
no cdp enable
spanning-tree portfast
!
I'm looking for an old hub to try and help isolate the problem to either the switch or Ethereal.

 

[RickLopez2]

I found an old Synoptics hub and plugged everything into that and started an Ethereal session and I can see all traffic on the hub which points me back to a problem with my Cisco configuration I assume. Thanks.

 

[vipergg]

Don't know this looks exactly right , you can go here and look but it looks just like what you have .

http://cisco.com/en/US/products/hw/...figuration_guide_chapter09186a00801a6ba9.html

 

[vipergg]

Try this "monitor session 1 destination interface Fa0/1 - 23 , Gi0/1 - 2 ingress vlan 1 . If this doesn't then I'm not sure what is going on

 

[RickLopez2]

Tried setting source ports to ingress with same results. Decided to start over, erased switch config and setup only minimal configuration, then setup SPAN with same results. Here's a summary of the current config;

show run
Building configuration...

Current configuration : 1622 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname era-2950
!
enable secret 5 $1$3kmu$5aEYUfsTwaxSa7armVx5r.
enable password xxxxxxx
!
ip subnet-zero
!
spanning-tree extend system-id
!
!
interface FastEthernet0/1
no ip address
!
interface FastEthernet0/
no ip address
!
interface FastEthernet0/3
no ip address
!
interface FastEthernet0/4
no ip address
!
interface FastEthernet0/20
no ip address
!
interface FastEthernet0/21
no ip address
!
interface FastEthernet0/22
no ip address
!
interface FastEthernet0/23
no ip address
!
interface FastEthernet0/24
no ip address
!
interface GigabitEthernet0/1
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface Vlan1
ip address x.x.x.x 255.255.255.0
no ip route-cache
!
ip http server
!
!
line con 0
exec-timeout 0 0
line vty 0 4
password xxxxxxxxx
login
line vty 5 15
password xxxxxxxxxx
login
!
end

era-2950#show monitor
Session 1
---------
Source Ports:
RX Only: None
TX Only: None
Both: None
Destination Ports: None

Reconfigured for SPAN

era-2950#show monitor
Session 1
---------
Source Ports:
RX Only: None
TX Only: None
Both: Fa0/1-23,Gi0/1-2
Destination Ports: Fa0/24

I'm not sure what to even try at this point?