Cisco Monitoring Problem

Posted on 2007-10-03
Last Modified: 2012-06-21
Hey here what i need to do :)

I have Cisco Catalist 2950 and i have more then 200 PC's i have one SERVER special added in the switch just to Monitor all trafic which is send to my PIX which is added in the switch in.
i use Ethernal for monitoring

when i set monitor on my switch and add the command :
monitor session 1 source interface gigabit0/1
monitor session 1 destination interface fa0/24

My server is getting DAMN CRAZY dosent move and its :

Intel(R) Xnenon(TM) 3.60GHZ
with 3Giga RAM

i really dont understande why my Server crashes
Question by:munemgumen
    LVL 2

    Expert Comment

    What is connected to your gigabit 0/1 interface - if it's an uplink to another switch, that's not the interface you'd want to select.  I've done this before, using wireshark (ethereal's current iteration), by mirroring the switchport that the pix is connected to to the switchport the wireshark monitoring server is connected to.  Also, configure ethereal/wireshark to monitor traffic with the destination ip of your pix, so you aren't picking up all the broadcast crap traffic.

    Author Comment

    So i have just one switch and all goes inside in.

    So my pix is on my 11-port and my BACKUPserver is on 16

    i fxided up the swhitch with the connamd up and all just ins getting on my Server i dont have even time to set up anything the damn server just BLOCKS.

    what do you think ?

    regards, Igor
    LVL 2

    Expert Comment

    I don't quite understand what you're saying in your last post.
    It sounds like you're saying this 'backupserver' is on a different switch (16-port) than the pix (11-port), but you start by saying 'So I have just one switch....'.  Is it 1 switch with vlans - is that what you mean?

    Author Comment

    i have Switch Cisco Catalyst 2950

    I have the PIX on the other side which is connected to this PIX and its on port 11.
    all other subnetworks are connected to this mail Switch i had one more free port on this switch and i added an special server there just so i monitor all traffic on port 11

    there i think you can understande me now.
    LVL 2

    Accepted Solution

    Ok - so if I understand correctly, the pix is on port 11, and the monitoring server is on port 16.  
    1)Setup port mirroring so that port 11traffic  is mirrored to port 16
    2)Configure ethereal on the monitoring server to sniff traffic bound for the pix's ip address.

    That should do it.
    LVL 1

    Expert Comment

    Forced accept.

    EE Admin

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    Many companies are looking to get out of the datacenter business and to services like Microsoft Azure to provide Infrastructure as a Service (IaaS) solutions for legacy client server workloads, rather than continuing to make capital investments in h…
    PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now