From: Scott Morris (swm@emanon.com)
Date: Thu Jun 01 2006 - 16:12:44 ART
Or DLSW! :)
But likely one of those big areas of hidden commands (typically done because
it is NOT a good idea to use your router as a sniffer!)
Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713, JNCIE
#153, CISSP, et al.
CCSI/JNCI
IPExpert CCIE Program Manager
IPExpert Sr. Technical Instructor
smorris@ipexpert.com
http://www.ipexpert.com
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of Petr
Lapukhov
Sent: Thursday, June 01, 2006 2:42 PM
To: Schulz, Dave
Cc: ccielab@groupstudy.com
Subject: Re: SPAN - Using a router as a sniffer
Dave,
the only thing I find at that time is RMON promiscuous mode :) But it is not
implemented on most of Cisco platforms :)
http://www.netcraftsmen.net/welcher/papers/rmon.pdf
Petr
2006/6/1, Schulz, Dave <DSchulz@dpsciences.com>:
>
> Group -
>
> I have been going over some of the switching subjects, specifically
> SPAN and am trying to use a router as a monitor/sniffer. I thought
> that there was a way to do this, but I can't seem to get it to work.
> I have set up IP on the fastethernet interface of a 3640, and set the
> interface to "no ip route-cache" to see the debug packets. Then, did
> a "debup ip packet detail".
>
> When I set up the SPAN, I can do the show command on the switch and
> notice that it is in monitoring, and packets are sent out of the
> interface.....however, the packets are not being received at the
> router interface that is doing the monitoring (or suppose to be doing
> the monitoring). Any thoughts? Maybe this just can't be done, but I
> thought someone did this before.
>
>
> Dave Schulz
>
> Email: dschulz@dpsciences.com <mailto:dschulz@dpsciences.com >
>
> ______________________________________________________________________
> _ Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
This archive was generated by hypermail 2.1.4 : Sat Jul 01 2006 - 07:57:31 ART