From: Petr Lapukhov (petrsoft@gmail.com)
Date: Thu Jun 01 2006 - 15:48:43 ART
Sure,
But that won't catch packets heading to the other mac-address
on segment :) Only the ones that traverse router itself. So you will
miss much of your SPAN data.
Another option would be to use that RITE feature...
Petr
2006/6/1, Victor Cappuccio <cvictor@protokolgroup.com>:
>
> Or you can disable route cache in all interfaces and do a debug ip packet
> dump
>
>
> -----Mensaje original-----
> De: nobody@groupstudy.com [mailto:nobody@groupstudy.com] En nombre de Petr
> Lapukhov
> Enviado el: Jueves, 01 de Junio de 2006 02:23 p.m.
> Para: Schulz, Dave
> CC: ccielab@groupstudy.com
> Asunto: Re: SPAN - Using a router as a sniffer
>
> You clearly need to set interface to promiscuous mode :)
>
> while it seems to be "possible":
>
> R1#show controllers fastEthernet 0/0 | inc Promisc
> Promiscuous Mode Disabled, PHY Addr Enabled, Broadcast Addr Enabled
>
> I'm still looking for a way to enable that :)) Maybe that is some
> undocumented command. You see, routers are rarely used as
> packet sniffers :)
>
> Petr
>
> 2006/6/1, Schulz, Dave <DSchulz@dpsciences.com>:
> >
> > Group -
> >
> > I have been going over some of the switching subjects, specifically
> > SPAN and am trying to use a router as a monitor/sniffer. I thought that
> > there was a way to do this, but I can't seem to get it to work. I have
> > set up IP on the fastethernet interface of a 3640, and set the interface
> > to "no ip route-cache" to see the debug packets. Then, did a "debup ip
> > packet detail".
> >
> > When I set up the SPAN, I can do the show command on the switch and
> > notice that it is in monitoring, and packets are sent out of the
> > interface.....however, the packets are not being received at the router
> > interface that is doing the monitoring (or suppose to be doing the
> > monitoring). Any thoughts? Maybe this just can't be done, but I
> > thought someone did this before.
> >
> >
> > Dave Schulz
> >
> > Email: dschulz@dpsciences.com <mailto:dschulz@dpsciences.com >
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
This archive was generated by hypermail 2.1.4 : Sat Jul 01 2006 - 07:57:31 ART