Mirror traffic in Cisco Switch 3750

Dear Experts, I'm testing the SPAN feature in Switch Cisco 3750. This is the diagram:

This is configuration on Core SW:

monitor session 1 source vlan 55 both
monitor session 1 destination interface g1/0/13

Open in new window

It seems like working but the whole vlan 18 was hang, so I could NOT access the PC which was installed wireshark. How can I fix it? Can we just mirror traffic from some IP addresses, not all VLAN?

Many thanks as always!
TjnoNetwork AdministratorAsked:
Who is Participating?
atlas_shudderedSr. Network EngineerCommented:
Yes, you can source from multiple IP addresses by resolving IP address to MAC to interface and the SPANing the interfaces those hosts are connected to.
Craig BeckCommented:
When you say "I could NOT access the PC which was installed wireshark", were you trying to access the PC remotely?  If so, that won't work as the PC running Wireshark is connected to a port which just receives traffic.  The monitor destination interface can't be used as a normal port.

You can monitor specific ports if you want to, like this...

monitor session 1 source interface gi1/0/1
monitor session 1 destination interface gi1/0/13

Open in new window

Pete LongTechnical ConsultantCommented:
Agreed your confusing RSPAN and SPAN :)
TjnoNetwork AdministratorAuthor Commented:
Hi Pete, refer to this diagram, can we achieve correct RSPAN when the physical destination interface (g1/0/13) is connected to ESXi host? not the physical PC

we would like to mirror traffic from VLAN 55 through VLAN200 to that VM server


Update: Yes, I tested and it worked but again, cannot remote desktop to VM with that monitored interface
All Courses

From novice to tech pro — start learning today.