Posts tagged ‘VLAN’

How to configure SPAN in Cisco Catalyst

SPAN (Switch Port Analyzer) is a great tool for troubleshooting Cisco switches and to figure out where your traffic really is heading.
The technique is called Port Mirroring, as a general term, since you’re mirroring the traffic and sending it to a specific port where you have your analyzing software waiting.
Other vendors usually have their own specific names like 3com’s Roving Analysis Port (RAP) but the technique is often very similar.

An overview
SPAN

What you need to do is this

conf t
monitor session 1 source interface gigabitEthernet 0/5
monitor session 1 destination interface gigabitEthernet 0/10

This will mirror the traffic on interface gigabitEthernet 0/5 and send it to gigabitEthernet 0/10
If you want to monitor multiple ports just add them like this:

conf t
monitor session 1 source interface gigabitEthernet 0/5 , 0/6 , 0/7
monitor session 1 destination interface gigabitEthernet 0/10

To monitor traffic on a specific VLAN (VSPAN)

conf t
monitor session 1 source vlan 100
monitor session 1 destination interface gigabitEthernet 0/10

I would recommend using software like Wireshark to analyze the received data.

To mirror traffic on remote switches, read about RSPAN (Remote SPAN) here
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/5.x/configuration/guide/span.html#wp1020150

A lot of information is available on cisco.com aswell.
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml

  • Facebook
  • Twitter
  • Digg
  • del.icio.us
  • LinkedIn
  • RSS
  • StumbleUpon
  • Google Bookmarks
  • Yahoo! Buzz
  • email
  • MySpace
  • PDF
  • Print
  • Reddit
  • Tumblr

Why VTP is bad, mkey.

* In a configured VTP domain, whatever device has the highest VTP table revision wins.
Which, in short, means if you buy a switch from Ebay, and it happens to have had its VLAN table changed 289 times, while your LAN only 288.
You plug it in, change domain and password, BOOM, no more VLANs.

* VTP 2 pruning is not all-seeing, so if you use VLANs sufficiently creatively, especially in combination with STP, you might suddenly discover traffic isn’t really making it to places where it should.

… and to sum it up

* If you manage enough switches to benefit from VTP, but don’t have a central provisioning platform which allows you to add/remove VLANs from all of them one by one via systematic configuration / CLI execution, you’ve already lost.

A great platform for this is Rancid, read more here: http://www.shrubbery.net/rancid/

Streetcred to redLED.

  • Facebook
  • Twitter
  • Digg
  • del.icio.us
  • LinkedIn
  • RSS
  • StumbleUpon
  • Google Bookmarks
  • Yahoo! Buzz
  • email
  • MySpace
  • PDF
  • Print
  • Reddit
  • Tumblr