Cisco 4500M Command Reference Manual page 216

monitor session
Usage Guidelines
Only one SPAN destination for a SPAN session is supported. If you attempt to add another destination
interface to a session that already has a destination interface configured, you will get an error. You must
first remove a SPAN destination interface before changing the SPAN destination to a different interface.
With release 12.1(12c)EW, you can configure sources from different directions within a single user
session.
Note
A particular SPAN session can either monitor VLANs or monitor individual interfaces: you cannot have
a SPAN session that monitors both specific interfaces and specific VLANs. If you first configure a
SPAN session with a source interface, and then try to add a source VLAN to the same SPAN session,
you will receive an error. You will also receive an error message if you configure a SPAN session with
a source VLAN , and then try to add a source interface to that session. You must first clear any sources
for a SPAN session before switching to another type of source. CPU sources may be combined with
source interfaces and source VLANs.
When configuring the ingress option on a destination port, you must specify an ingress VLAN if the
configured encapsulation type is untagged (the default) or is 802.1q. If the encapsulation type is ISL,
then no ingress VLAN specification is necessary.
By default, when you enable ingress, no host learning is performed on destination ports. When you enter
the learning keyword, host learning is performed on the destination port, and traffic to learned hosts is
forwarded out the destination port.
If you enter the filter keyword on a monitored trunking interface, only traffic on the set of specified
VLANs is monitored. Port channel interfaces are displayed in the list of interface options if you have
them configured. VLAN interfaces are not supported. However, you can span a particular VLAN by
entering the monitor session session source vlan vlan-id command.
Packet-type filters are only supported in the RX direction. You can specify both Rx- and Tx-type filters
as well as multiple-type filters at the same time (for example, you can use good and unicast to only sniff
no nerror unicast frames). As with VLAN filters, if you do not specify the type, then the session will sniff
all packet types.
The queue identifier allows sniffing for only traffic sent or received on the specified CPU queues.
Queues may be identified either by number or by name. Queue names may contain multiple numbered
queues for convenience.
Examples
This example shows how to add a source interface to a SPAN session:
Switch(config)# monitor session 1 source interface fa2/3
Switch(config)#
This example shows how to configure sources with different directions within a SPAN session:
Switch(config)# monitor session 1 source interface fa2/3 rx
Switch(config)# monitor session 1 source interface fa2/2 tx
Switch(config)#
This example shows how to remove a source interface from a SPAN session:
Switch(config)# no monitor session 1 source interface fa2/3
Switch(config)#
Catalyst4500 Series SwitchCiscoIOS Command Reference—Release 12.2(18)EW
2-184
With release 12.1(12c)EW, SPAN is limited to two sessions containing ingress sources and
four sessions containing egress sources. Bidirectional sources support both ingress and
egress sources.
Chapter2 Cisco IOS Commands for the Catalyst 4500 Series Switches
78-16201-01