Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco WS-C2960S-24TS-S switch and would like enable a port mirror for network analyzer (such as Snort). I could not see any options in the GUI interface.

Is it possible, and how do I enable it without a reboot?

share|improve this question
I've never used a GUI interface to manage my switches, but i think that C2960S is able to do that. From the console (or ssh/telnet) i would try (in conf t mode) : "monitor session 1 source interface fa0/12 both" and "monitor session 1 destination interface fa0/4" – krisFR Dec 11 '13 at 14:08
this is the way it works. if you would like to have access to the network on your Snort Box you had to specify an ingress VLAN in the destination interface command "monitor session 1 destination interface fa0/4 ingress vlan X" – user1008764 Dec 11 '13 at 14:14
thank you for your replies. there is currently no vlan setup. do I just put vlan 1? – John Dec 11 '13 at 14:23

You use the command line to enable port mirroring/SPAN, and a reboot is not required.

The below example (from the linked document) will mirror the traffic on Gigabit Ethernet port 0/1 to Gigabit Ethernet port 0/2.

Switch(config)# no monitor session 1

Switch(config)# monitor session 1 source interface gigabitethernet0/1

Switch(config)# monitor session 1 destination interface gigabitethernet0/2 
encapsulation replicate

Switch(config)# end
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.