Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Cisco WS-C2960S-24TS-S switch and would like enable a port mirror for network analyzer (such as Snort). I could not see any options in the GUI interface.

Is it possible, and how do I enable it without a reboot?

share|improve this question
1  
I've never used a GUI interface to manage my switches, but i think that C2960S is able to do that. From the console (or ssh/telnet) i would try (in conf t mode) : "monitor session 1 source interface fa0/12 both" and "monitor session 1 destination interface fa0/4" –  krisFR Dec 11 '13 at 14:08
    
this is the way it works. if you would like to have access to the network on your Snort Box you had to specify an ingress VLAN in the destination interface command "monitor session 1 destination interface fa0/4 ingress vlan X" –  user1008764 Dec 11 '13 at 14:14
    
thank you for your replies. there is currently no vlan setup. do I just put vlan 1? –  John Dec 11 '13 at 14:23

1 Answer 1

You use the command line to enable port mirroring/SPAN, and a reboot is not required.

The below example (from the linked document) will mirror the traffic on Gigabit Ethernet port 0/1 to Gigabit Ethernet port 0/2.

Switch(config)# no monitor session 1

Switch(config)# monitor session 1 source interface gigabitethernet0/1

Switch(config)# monitor session 1 destination interface gigabitethernet0/2 
encapsulation replicate

Switch(config)# end
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.