?
Solved

SPAN output and regular traffic on the same switchport?

Posted on 2009-04-08
4
Medium Priority
?
607 Views
Last Modified: 2012-05-06
I have a 3750 series switch that I'm trying to use along with ntop to monitor bandwidth usage by inside host on our network.

The ntop host has 1 NIC and is connected to G1/0/13 on the 3750.  G1/0/13 is an access port on VLAN 1, and I can communicate with the ntop host with no problems before I set up the SPAN session.

Our firewall's inside interface is on VLAN 208, and the 3750 is doing IP routing between our different VLANs, so I set up a SPAN session like this:

monitor session 1 source vlan 208
monitor session 1 destination interface Gi1/0/13 ingress untagged vlan 1

That seems to work as far as getting all of the packets sent to/from our firewall to ntop, however as soon as I set up the monitor session I can no longer ping the ntop host.  I thought the ingress keyword would permit traffic from the ntop host back into the switch and dump it on VLAN 1, but apparently that's not the case.

What do I need to do so I can send the output of the monitor session to the ntop host, AND still be able to communicate with the ntop host?
0
Comment
Question by:FWeston
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24099684
Yeah, that should work.

You can always use a second NIC in the nTop host and plug it into VLAN1 to be used for communication to the host and leave the g1/0/13 NIC as the capture only NIC.
0
 
LVL 3

Author Comment

by:FWeston
ID: 24099711
I thought about that, but the system ntop is running on is a SFF desktop, so I'd have to purchase a special low-profile NIC.  Since this should work, I'd like to figure this out before I spend money on something I shouldn't need.

What should I do to figure out why the above isn't working as I thought it should?
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24107067
Personally I don't like mixing the capture and management traffic as you end up with the management and "normal" host traffic mixed in with your results.

If the SFF desktop has USB, here is a cheap option to add a second NIC:

http://www.newegg.com/Product/Product.aspx?Item=N82E16833124335&nm_mc=OTC-Froogle&cm_mmc=OTC-Froogle-_-Network+-+Interface+Cards-_-Linksys-_-33124335

Otherwise, I'll try to replicate this and see if it works for me.  Standby...
0
 
LVL 3

Accepted Solution

by:
FWeston earned 0 total points
ID: 24107207
I'm not sure what the root issue was, but I was able to achieve what I wanted by changing g1/0/13 to an access port on vlan 208.
0

Featured Post

ATEN's HDBaseT Presentation at InfoComm 2017

Hear ATEN Product Manager YT Liang review HDBaseT technology, highlighting ATEN’s latest solutions as they relate to real-world applications during her presentation at the HDBaseT booth at InfoComm 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The worst thing when starting a new job is when the previous Network Administrator left behind no documentation. How do you get into the devices? If you've been in this situation or just accidently mistyped your password, this article will hopefully…
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question