Message: 3 Date: Tue, 18 Jan 2005 09:36:14 -0500 From: "Todd, Douglas M." <DTODD at PARTNERS.ORG> Subject: [c-nsp] Re: 6500 Port Monitor To: "'Voll, Scott'" <Scott.Voll at wesd.org>, Ziv Mosery <zmosery at mercury.com>, Piltrafilla <piltrafilla at gmail.com> Cc: cisco-nsp at puck.nether.net Message-ID: <59C772E2D8EDF345AE1601F5B60B3CB50D3DB1 at PHSXMB7.partners.org> Content-Type: text/plain

Hey folks:

We run spans/monitors ports all the time and we have not found such a limitation. One would want to have the monitor port in the same vlan as the monitor source to catch ALL traffic. It seems that you will catch more traffic by moving the port in the same vlan as the span, just seems to be the better way to sniff. I would check to make sure that you are not getting errors on your port as this might be one cause of your traffic limitation.

==DMT>

%SIG%

Douglas M. Todd, Jr. Network Engineering (MGH/CNY/NSMC/MCLEAN) Partners Health Care Building 149 13th Street Location: 149-10-10056E Charlestown, MA 02129-2000 (MGH) (T): 617.726.1403 (F): 617.724.9871 Security: Verisign S/N: 7b1bb86860eb26a53b57c8acb8e9fc4f pgp: search keyserver for: dtodd at partners.org

--------------------------------------------------------------------------

------

---- The information transmitted in this email is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged information. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended

recipient is prohibited. If you received this email in error, please contact the sender and delete the material from any computer.

old>>-----Original Message----- old>>From: cisco-nsp-bounces at puck.nether.net old>>[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Voll, Scott old>>Sent: Tuesday, January 18, 2005 07:16 old>>To: Ziv Mosery; Piltrafilla old>>Cc: cisco-nsp at puck.nether.net old>>Subject: [c-nsp] Re: 6500 Port Monitor old>> old>>Someone can correct me if I'm wrong, but I believe the old>>limit is that both ports have to be in the same Vlan. old>> old>>Scott old>> old>>-----Original Message----- old>>From: cisco-nsp-bounces at puck.nether.net old>>[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ziv Mosery old>>Sent: Tuesday, January 18, 2005 2:06 AM old>>To: Piltrafilla; Ziv Mosery old>>Cc: cisco-nsp at puck.nether.net old>>Subject: [c-nsp] Re: 6500 Port Monitor old>> old>>Thanks I found the solution but I don't know what the problem was. old>>I had 2 destination ports both 10/100/1000 ports, one on old>>1000MB and one on 100MB. old>>Was I limited because of the 100MB port? old>>Or is there some kind of limit after all? old>>After I did monitor only to the 1000MB port I was able to old>>get 160MB on the monitor, my probe isn't able to get more old>>than that so I don't know If there is a 200MB limit or not. old>> old>>Thanks, old>>Ziv old>> old>> old>>-----Original Message----- old>>From: Piltrafilla [mailto:piltrafilla at gmail.com] old>>Sent: Tuesday, January 18, 2005 11:58 AM old>>To: Ziv Mosery old>>Cc: cisco-nsp at puck.nether.net old>>Subject: Re: [c-nsp] 6500 Port Monitor old>> old>>I have done vlan monitor sessions on that way without any old>>bandwidth limitation on SupII and Sup720. Could you paste old>>destination interface configuration and 'sh ip interface' old>>information? old>> old>>Regards, old>> old>>On Tue, 18 Jan 2005 10:38:06 +0200, Ziv Mosery old>><zmosery at mercury.com> old>>wrote: old>>> Hi all, old>>> old>>> I am trying to do port monitoring from a VLAN to a GigE old>>destination. old>>> old>>> For some reason I am don't get at the destination more old>>then 100MB. old>>> old>>> Any reason for that? old>>> old>>> Switch details: 6500 Sup2 MSFC2. old>>> old>>> Configuration used: old>>> old>>> monitor session 2 source vlan 13 old>>> old>>> monitor session 2 destination interface Gi10/45 old>>> old>>> Anyone knows of limitations that the switch might have old>>regarding port old>>> monitor? old>>> old>>> Thanks in advance, old>>> old>>> Ziv old>>> old>>> old>>___________________________________________________________ old>>___________ old>>> This email has been scanned by the MessageLabs Email old>>Security System. old>>> For more information please visit old>>http://www.messagelabs.com/email old>>> old>>___________________________________________________________ old>>___________ old>>> _______________________________________________ old>>> cisco-nsp mailing list cisco-nsp at puck.nether.net old>>> https://puck.nether.net/mailman/listinfo/cisco-nsp old>>> archive at http://puck.nether.net/pipermail/cisco-nsp/ old>>> old>> old>>___________________________________________________________ old>>___________ old>>This email has been scanned by the MessageLabs Email old>>Security System. old>>For more information please visit old>>http://www.messagelabs.com/email old>>___________________________________________________________ old>>___________ old>>_______________________________________________ old>>cisco-nsp mailing list cisco-nsp at puck.nether.net old>>https://puck.nether.net/mailman/listinfo/cisco-nsp old>>archive at http://puck.nether.net/pipermail/cisco-nsp/ old>> old>>_______________________________________________ old>>cisco-nsp mailing list cisco-nsp at puck.nether.net old>>https://puck.nether.net/mailman/listinfo/cisco-nsp old>>archive at http://puck.nether.net/pipermail/cisco-nsp/ old>>