[ LiB ] |
The single command to configure SPAN on the Catalyst 4000, 4500 and 6500 switches is the set span command. The following example sets port 5 on module 4 as a source port and port 1 on module 3 as the destination SPAN port. You use the optional keyword create to create the SPAN port, whereas the optional keyword rx specifies that only ingress traffic on the source port, module 4 port 5, will be mirrored to the SPAN port:
switch>(enable) set span 4/5 3/1 rx create
The command syntax to enable and configure or disable SPAN on the Catalyst 4000, 4500, and 6500 switches is as follows :
set span { src_mod/src_ports ... src_vlans ... sc0} { dest_mod/dest_port } [rxtxboth][inpkts{enabledisable}] [learning {enabledisable}] [multicast {enabledisable}] [filter vlans ... ] [create] set span disable [ dest_mod/dest_port all]
Table 4.2 lists and describes the command syntax for the set span command.
Command Syntax | Description |
---|---|
src_mod | Monitored module (SPAN source) |
src_ports... | Monitored ports (SPAN source) |
src_vlans... | Monitored VLANs (SPAN source) |
sc0 | Keyword to specify that the inbound port is a valid source |
rx | (Optional) Keyword to specify that traffic received at the source port (ingress SPAN) is monitored |
tx | (Optional) Keyword to specify that traffic sent from the source port (egress SPAN) is monitored |
both | (Optional) Keyword to specify that both ingress SPAN and egress SPAN are monitored |
inpkts enable | (Optional) Keywords to enable the receipt of inbound traffic on the SPAN destination port |
inpkts disable | (Optional) Keywords to disable the receipt of inbound traffic on the SPAN destination port |
learning enable | (Optional) Keywords to enable learning on the SPAN destination port |
learning disable | (Optional) Keywords to disable learning on the SPAN destination port |
multicast enable | (Optional) Keywords to enable multicast traffic (egress only) |
multicast disable | (Optional) Keywords to disable multicast traffic (egress only) |
filter vlans | (Optional) Keyword and variable to monitor traffic on selected VLANs on source trunk ports |
create | (Optional) Keyword to create a SPAN port |
disable | Keyword to disable SPAN |
dest_mod | (Optional) Monitoring module (SPAN destination) |
dest_port | (Optional) Monitoring port (SPAN destination) |
all | (Optional) Keyword to disable all SPAN sessions |
For the exam, remember that you use the inpkts enable keywords in the set span command to allow the 4000, 4500, and 6500 switches to receive a TCP reset packet from the Sensor on their destination SPAN ports. |
[ LiB ] |