If I am configuring SPAN on cisco switch and the source port is hard coded to 1000/FULL. Do I have to configure the destination port(port where I am connecting my laptop running wireshark) to 1000/FULL or I can leave it to Auto/auto. Please confirm. Thanks.. asked 10 Nov '15, 11:59 packetninja101 |
3 Answers:
Depends on what you mean with source port: answered 10 Nov '15, 12:23 Christian_R edited 10 Nov '15, 13:37 |
Solution: The best way would be to leave both at Auto-Negotiation and let them negotiate or set both at 1000 Full. Sometimes an "asymmetric" combination works, sometimes it does not. Most of the time you will get a Duplex mismatch. It really depends on your switch and your Laptop. Regards answered 10 Nov '15, 12:26 Kurt Knochner ♦ edited 10 Nov '15, 12:32 |
1) There is no relationship between how the link speed and duplex is obtained at the monitored port(s) and at the SPAN port. 2) when talking about a single port, you may have actually three types of setting:
Here what Kurt wrote applies - depending on the particular equipment types on the two ends of a cable, some "asymmetric" combinations may work. 3) the most important point is that the sum of traffic on the monitored port(s) must not exceed the unidirectional speed of the SPAN port. I.e. if you monitor a single 1000/full port, the sum of traffic volumes "in" and "out" may be up to 2 Gbit/s, so if it really exceeds 1 Gbit/s for an extended period of time, it won't fit to the SPAN port and you won't see part of it in your Wireshark capture. answered 10 Nov '15, 13:29 sindy edited 10 Nov '15, 13:47 |