Re: SPAN - Using a router as a sniffer

From: Petr Lapukhov (petrsoft@gmail.com)
Date: Thu Jun 01 2006 - 15:42:15 ART


Dave,

the only thing I find at that time is RMON promiscuous mode :)
But it is not implemented on most of Cisco platforms :)

http://www.netcraftsmen.net/welcher/papers/rmon.pdf

Petr

2006/6/1, Schulz, Dave <DSchulz@dpsciences.com>:
>
> Group -
>
> I have been going over some of the switching subjects, specifically
> SPAN and am trying to use a router as a monitor/sniffer. I thought that
> there was a way to do this, but I can't seem to get it to work. I have
> set up IP on the fastethernet interface of a 3640, and set the interface
> to "no ip route-cache" to see the debug packets. Then, did a "debup ip
> packet detail".
>
> When I set up the SPAN, I can do the show command on the switch and
> notice that it is in monitoring, and packets are sent out of the
> interface.....however, the packets are not being received at the router
> interface that is doing the monitoring (or suppose to be doing the
> monitoring). Any thoughts? Maybe this just can't be done, but I
> thought someone did this before.
>
>
> Dave Schulz
>
> Email: dschulz@dpsciences.com <mailto:dschulz@dpsciences.com >
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html



This archive was generated by hypermail 2.1.4 : Sat Jul 01 2006 - 07:57:31 ART