Cisco 4500M Software Manual page 545

Chapter 39 Configuring SPAN and RSPAN
To configure CPU source sniffing, perform this task:
Command
Switch(config)# [no] monitor session
{ session_number } {source {interface
interface_list | {vlan vlan_IDs | cpu
[queue queue_ids ] } [rx | tx | both]
This example shows how to configure a CPU source to sniff all packets received by the CPU:
Switch(config)# monitor session 1 source cpu rx
This example shows how to use queue names and queue number ranges for the CPU as a SPAN source:
Switch(config)# monitor session 2 source cpu queue control-packet rx
Switch(config)# monitor session 3 source cpu queue 21 -23 rx
OL-6696-01
Purpose
Specifies that the CPU will cause traffic received
by or sent from the CPU to be copied to the
destination of the session. The queue identifier
optionally allows sniffing-only traffic (received)
on the specified CPU queue(s).
For session_number, specifies the session number
identified with this SPAN session (1 through 6).
For interface-list, specifies the source port to
monitor. Valid interfaces include physical
interfaces and port-channel logical interfaces
(port-channel port-channel-number).
For vlan_IDs, specifies the source VLAN.
For queue_ids, specifies the queue(s) involved.
(Optional) [, | -] Specifies a series or range of
interfaces. Enter a space after the comma; enter a
space before and after the hyphen.
(Optional) Specifies the direction of traffic to
monitor. If you do not specify a traffic direction,
the source interface sends both transmitted (Tx)
and received (Rx) traffic. Only received traffic
can be monitored on additional source ports.
• Rx—Monitor received traffic.
Tx—Monitor transmitted traffic.
•
both—Monitor both received and transmitted
•
traffic (bidirectional).
Queues may be identified either by number or by
name. Queue names may subsume multiple
numbered queues for convenience.
Use the no keyword to restore the defaults.
Software Configuration Guide—Release 12.2(25)EW
CPU Port Sniffing
39-11