This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Port Mirroring on cisco switch

0

If I am configuring SPAN on cisco switch and the source port is hard coded to 1000/FULL. Do I have to configure the destination port(port where I am connecting my laptop running wireshark) to 1000/FULL or I can leave it to Auto/auto. Please confirm.

Thanks..

asked 10 Nov '15, 11:59

packetninja101's gravatar image

packetninja101
6223
accept rate: 0%


3 Answers:

0

If I am configuring SPAN on cisco switch and the source port is hard coded to 1000/FULL. Do I have to configure the destination port(port where I am connecting my laptop running wireshark) to 1000/FULL

Depends on what you mean with source port:
1. If you mean with the source port the source of the span definition, then you can leave it at Auto if your Laptop is at Auto, too. And both devices should support 1000 MBit/s. (This happens mostly if want to monitor a FX link on a TX Port)

2. If you mean with source port: The switch port your laptop is connected directly, then you should configure the switch port and the laptop in the same way. (Hint: If it is a TX Link and you want to use it with 1000 MBit/s, then the mandatory/recommended setup by Cisco is Speed: Auto, Duplex: Auto)

answered 10 Nov '15, 12:23

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

edited 10 Nov '15, 13:37

0

Do I have to configure the destination port(port where I am connecting my laptop running wireshark) to 1000/FULL or I can leave it to Auto/auto.

Solution: The best way would be to leave both at Auto-Negotiation and let them negotiate or set both at 1000 Full.

Sometimes an "asymmetric" combination works, sometimes it does not. Most of the time you will get a Duplex mismatch. It really depends on your switch and your Laptop.

Regards
Kurt

answered 10 Nov '15, 12:26

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 10 Nov '15, 12:32

0

1) There is no relationship between how the link speed and duplex is obtained at the monitored port(s) and at the SPAN port.

2) when talking about a single port, you may have actually three types of setting:

  • fixed with no negotiation (e.g. 1000, full)
  • fixed with negotiation permitted (e.g. auto, auto but only a single negotiable value 1000, full),
  • negotiation permitted with a choice of several permitted options (e.g. 10/100/1000, half/full).

Here what Kurt wrote applies - depending on the particular equipment types on the two ends of a cable, some "asymmetric" combinations may work.

3) the most important point is that the sum of traffic on the monitored port(s) must not exceed the unidirectional speed of the SPAN port. I.e. if you monitor a single 1000/full port, the sum of traffic volumes "in" and "out" may be up to 2 Gbit/s, so if it really exceeds 1 Gbit/s for an extended period of time, it won't fit to the SPAN port and you won't see part of it in your Wireshark capture.

answered 10 Nov '15, 13:29

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

edited 10 Nov '15, 13:47