SPAN port on Cat 4006

Discussion in 'Cisco' started by Chad Mahoney, Apr 4, 2008.

  1. Chad Mahoney

    Chad Mahoney Guest

    Hi Group,

    I am trying to setup a SPAN port on a Cisco Cat 4006 running CATOS,
    however when I establish the SPAN port it shuts of the interface so I
    can no longer ping the device. Is this normal behavior or am I missing
    something?

    (enable) sh ver
    WS-C4006 Software, Version NmpSW: 7.4(2)
    Copyright (c) 1995-2002 by Cisco Systems, Inc.
    NMP S/W compiled on Oct 8 2002, 18:12:59
    GSP S/W compiled on Oct 08 2002, 15:54:51

    System Bootstrap Version: 5.4(1)

    Hardware Version: 3.2 Model: WS-C4006 Serial #: FOX0610031N

    Mod Port Model Serial # Versions
    --- ---- ------------------ --------------------
    ---------------------------------
    1 2 WS-X4013 JAE06140184 Hw : 3.2
    Gsp: 7.4(2.0)
    Nmp: 7.4(2)
    2 48 WS-X4148-RJ45V JAE0638073Q Hw : 2.6
    3 48 WS-X4148-RJ45V JAE065005NG Hw : 3.0
    4 48 WS-X4148-RJ45V JAE0638073R Hw : 2.6
    5 48 WS-X4148-RJ45V JAE06240BFV Hw : 2.7
    6 48 WS-X4148-RJ45V JAE061105E6 Hw : 3.0

    DRAM FLASH NVRAM
    Module Total Used Free Total Used Free Total Used Free
    ------ ------- ------- ------- ------- ------- ------- ----- ----- -----
    1 65536K 40025K 25511K 16384K 7803K 8581K 480K 351K 129K

    Uptime is 61 days, 17 hours, 19 minutes
    (enable)
     
    Chad Mahoney, Apr 4, 2008
    #1
    1. Advertising

  2. Chad Mahoney

    Trendkill Guest

    On Apr 4, 9:00 am, Chad Mahoney <> wrote:
    > Hi Group,
    >
    > I am trying to setup a SPAN port on a Cisco Cat 4006 running CATOS,
    > however when I establish the SPAN port it shuts of the interface so I
    > can no longer ping the device. Is this normal behavior or am I missing
    > something?
    >
    > (enable) sh ver
    > WS-C4006 Software, Version NmpSW: 7.4(2)
    > Copyright (c) 1995-2002 by Cisco Systems, Inc.
    > NMP S/W compiled on Oct 8 2002, 18:12:59
    > GSP S/W compiled on Oct 08 2002, 15:54:51
    >
    > System Bootstrap Version: 5.4(1)
    >
    > Hardware Version: 3.2 Model: WS-C4006 Serial #: FOX0610031N
    >
    > Mod Port Model Serial # Versions
    > --- ---- ------------------ --------------------
    > ---------------------------------
    > 1 2 WS-X4013 JAE06140184 Hw : 3.2
    > Gsp: 7.4(2.0)
    > Nmp: 7.4(2)
    > 2 48 WS-X4148-RJ45V JAE0638073Q Hw : 2.6
    > 3 48 WS-X4148-RJ45V JAE065005NG Hw : 3.0
    > 4 48 WS-X4148-RJ45V JAE0638073R Hw : 2.6
    > 5 48 WS-X4148-RJ45V JAE06240BFV Hw : 2.7
    > 6 48 WS-X4148-RJ45V JAE061105E6 Hw : 3.0
    >
    > DRAM FLASH NVRAM
    > Module Total Used Free Total Used Free Total Used Free
    > ------ ------- ------- ------- ------- ------- ------- ----- ----- -----
    > 1 65536K 40025K 25511K 16384K 7803K 8581K 480K 351K 129K
    >
    > Uptime is 61 days, 17 hours, 19 minutes
    > (enable)


    Like disables the source port? Please paste the config line and show
    span commands.
     
    Trendkill, Apr 4, 2008
    #2
    1. Advertising

  3. Chad Mahoney

    Chad Mahoney Guest

    Trendkill wrote:
    > Like disables the source port? Please paste the config line and show
    > span commands.


    Hi Trendkill,

    What I am trying to do, is have a host sniff all traffic on a common
    VLAN, all hosts are on VLAN 1.

    So I enter;

    set span 1 2/47
    Overwrote Port 2/47 to monitor transmit/receive traffic of VLAN 1
    Incoming Packets disabled. Learning enabled.
    (enable)

    So the port is now listening but it disables incoming packets so I can
    not remotely connect to the host sniffing the network. Would I just be
    better off adding a 2nd NIC card and be down with it?

    (enable) sh span

    Destination : Port 2/47
    Admin Source : VLAN 1
    Oper Source : Port 2/1-12,2/14-29,2/31-38,2/43-46,2/48,3/19,3/47
    Direction : transmit/receive
    Incoming Packets: disabled
    Learning : enabled
    Filter : -
    Status : active

    ------------------------------------------------------------------------
    Total local span sessions: 1
    (enable)


    #switch port analyzer
    set span 1 2/47 both inpkts disable learning enable create


    Thanks for the help...

    Chad
     
    Chad Mahoney, Apr 4, 2008
    #3
  4. Chad Mahoney <> writes:
    >Trendkill wrote:
    > > Like disables the source port? Please paste the config line and show
    >> span commands.


    >Hi Trendkill,


    >What I am trying to do, is have a host sniff all traffic on a common
    >VLAN, all hosts are on VLAN 1.


    >So I enter;


    > set span 1 2/47
    >Overwrote Port 2/47 to monitor transmit/receive traffic of VLAN 1
    >Incoming Packets disabled. Learning enabled.
    >(enable)


    >So the port is now listening but it disables incoming packets so I can
    >not remotely connect to the host sniffing the network. Would I just be
    >better off adding a 2nd NIC card and be down with it?



    Yes, thats normal SPAN behavior. You don't want remote access packets
    being mixed in with your monitored port data do you???
     
    Doug McIntyre, Apr 4, 2008
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Kevin

    4006 port with LED out

    Kevin, Nov 1, 2003, in forum: Cisco
    Replies:
    0
    Views:
    507
    Kevin
    Nov 1, 2003
  2. Chris

    Port SPAN cascading

    Chris, Dec 1, 2003, in forum: Cisco
    Replies:
    0
    Views:
    518
    Chris
    Dec 1, 2003
  3. Henry Hollenberg

    full gigabit on each port 4006 vs 6506

    Henry Hollenberg, Feb 13, 2004, in forum: Cisco
    Replies:
    2
    Views:
    653
    Henry Hollenberg
    Feb 14, 2004
  4. AM
    Replies:
    5
    Views:
    24,215
    GuyWithShoe
    Nov 14, 2008
  5. Chris
    Replies:
    6
    Views:
    2,557
    moizs
    Jan 17, 2007
Loading...

Share This Page