Specifications

2-396
Catalyst 4500 Series Switch Cisco IOS Command Reference—Release IOS XE 3.3.0XO(15.1(1)XO)
OL_28738 -01
Chapter 2 Cisco IOS Commands for the Catalyst 4500 Series Switches
monitor session
Usage Guidelines O nly one SPAN destination for a SPAN session is supported. If you attempt to add another destination
interface to a session that already has a destination interface that is configured, you will get an error. You
must first remove a SPAN destination interface before changing the SPAN destination to a different
interface.
Beginning in Cisco IOS Release 12.1(12c)EW, you can configure sou rces from different dire ctions
within a single user session.
Note Beginning in Cisco IOS Release 12.1(12c)EW, SPAN is limited to two sessions containing
ingress sources a nd four s essions c ontaining egress sources. B idirectiona l sourc es suppor t both
ingress and egress sources.
A particular SPAN session can either monitor VLANs or monitor individual interfaces: you cannot have
a SPAN session that monitors both specific interfaces and specific VLANs. If you first configure a SPAN
session with a source interface, and then try to add a source VLAN to the same SPAN session, you will
receive an error. You will also receive an error message if you configure a SPAN session with a source
VLAN, and then try to add a source interface to that session. You must first clear any sources for a SPAN
session before switching to another type of source. CPU sources may be combined with source interfaces
and source VL ANs.
When configuring the ingress option on a destination port, you must specify an ingress VLAN if the
configured encapsulatio n type is untagged (the defa ult) or is 802.1Q. If the encaps ulation type is ISL,
then no ingress VLAN specification is necessary.
By default, when you enable ing ress, no ho st learning i s perfo rmed on des tination por ts. When you enter
the learning keyword, host learning is performed on the destination port, and traffic to learned hosts is
forwarded out the destination po rt.
If you enter the filter keyword on a monitored trunking interface, only traffic on the set of specified
VLANs is monitored. Port-channel interfaces are displayed in the list of interface options if you have
them configured. VLAN interfa ces are not supported. However, you can span a particular VLAN by
entering the monitor session session source vlan vlan-id command.
The packet-type filters are supported only in the Rx direction. You can specify both Rx- and Tx-type
filters and multiple-type filters at the same time (for example, you can use good and unicast to only sniff
nonerror unicast frames). As with VLAN filters, if you do not specify the type, the session will sniff all
packet types.
The queue identifier allows sniffing for only traffic that is sent or received on the specified CPU queues.
The queues may be identified either by number or by name. The queue names may contain multiple
numbered queues for conve nience.
Examples This exampl e shows how to configure IP access gr oup 100 on a SPAN session:
Switch# configure terminal
Switch(config)# monitor session 1 filter ip access-group 100
Switch(config)# end
Switch(config)#
This example shows how to add a source inte rface to a SPAN session:
Switch# configure terminal
Switch(config)# monitor session 1 source interface fa2/3
Switch(config)# end
Switch(config)#
Switch(config)#
Switch(config)#