Comments on: SPANs on Cisco Switches

By: Aaron Conaway

Aaron Conaway — Fri, 29 May 2009 01:07:04 +0000

I’m glad to help, PB. :)

By: PB

PB — Thu, 28 May 2009 15:21:01 +0000

Wow – Great posting! I was blown away with how to configure that. While I’ve analyzed packets being captured, I never was quite sure how folks captured network packets through a “configured” sniffer port. For some reason I always thought it was in-line with it. That is a great piece of information for me. Additionally, I REALLY appreciate the link that Iain sent about the VACL-based methods for packet capture! Then we can really narrow down our data sets to look at. Thanks to the both of you!

By: Aaron’s Worthless Words » Blog Archive » RSPANs on Cisco Switches

Wed, 18 Mar 2009 20:12:02 +0000

[...] Disclaimer « SPANs on Cisco Switches [...]

By: Aaron Conaway

Aaron Conaway — Wed, 18 Mar 2009 15:30:40 +0000

Glad to see you here again, Clint.

There are a some commercial sniffers that use an inline tap to get traffic instead of relying on a switch to provide it for them. With a tap, you’re looking at the voltages on the pins themselves, so you don’t run into the problem of losing packets due to resource issue on the switch; you’re seeing exactly what comes through a cable in real-time. Some taps have multiple inputs, so you’re seeing the information on multiple wires at the same time without affecting the switch itself.

I’ve heard NetOptics makes a decent product, but I’ve never tried them myself.

By: Aaron Conaway

Aaron Conaway — Wed, 18 Mar 2009 15:24:28 +0000

Thanks for the link, Iain. Doing VACLs in a SPAN would be great in a whole mess of situations — like capturing traffic for a whole server farm or a list of vendor routers on your LAN. It’s also great for keeping your sniffer from seeing things like CDP, OSPF (or any other multicast routing protocol), STP, etc.

By: Clint Young

Clint Young — Wed, 18 Mar 2009 11:34:26 +0000

By: Iain

Iain — Mon, 16 Mar 2009 21:49:37 +0000

For those of you who want to do this on an enterprise network where you only want to capture specific traffic. This is a very slick feature. If you have the requirement to capture at an aggregate point (which would otherwise overwhelm your capture device) and know something about the type of data you want, then this is your ticket.

http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808122ac.shtml

Enjoy!