CISCO交换机端口镜像配置

CISCO交换机端口镜像配置[]

CISCO交换机端口镜像配置

先解释一下端口镜像：端口镜像简单的说，就是把交换机一个（数个）端口（源端口）的流量完全拷贝一份，从另外一个端口（目的端口）发出去，以便网络管理人员从目的端口通过分析源端口的流量来找出网络存在问题的原因。cisco的端口镜像叫做SWITCHED PORT ANALYZER，简称SPAN（仅在IOS系统中，下同），因此，端口镜像仅适用于以太网交换端口。Cisco的SPAN 分成三种，SPAN、RSPAN和VSPAN，简单的说，SPAN是指源和目的端口都在同一台机器上、RSPAN指目的和源不在同一交换机上，VSPAN可以镜像整个或数个VLAN 到一个目的端口。

配置方法：

1. SPAN

(1) 创建SPAN源端口

monitor session session_number source interface interface-id [, | -] [both | rx | tx] monitor session 1 source interface Gi1/0/3 - 23 monitor session 2 source interface Gi1/0/24

**session_number,SPAN会话号，我记得3550支持的最多本地SPAN是2个，即1或者2。

**interface-id [, | -]源端口接口号，即被镜像的端口，交换机会把这个端口的流量拷贝一份，可以输入多个端口，多个用“,”隔开，

比如我的3750G 设置：先查询镜像端口：

>show interface

GigabitEthernet1/0/1 is down, line protocol is down (monitoring) Hardware is Gigabit Ethernet, address is 001b.53d1.f681 (bia

001b.53d1.f681)

MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,

reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX

input flow-control is off, output flow-control is unsupported

ARP type: ARPA, ARP Timeout 04:00:00

Last input never, output 01:24:41, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

0 packets input, 0 bytes, 0 no buffer

Received 0 broadcasts (0 multicast)

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 0 multicast, 0 pause input

0 input packets with dribble condition detected

45270775 packets output, 3124068592 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out GigabitEthernet1/0/2 is up, line protocol is down (monitoring) Hardware is Gigabit Ethernet, address is 001b.53d1.f682 (bia

001b.53d1.f682)

MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,

reliability 255/255, txload 25/255, rxload 1/255 Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX

input flow-control is off, output flow-control is unsupported

ARP type: ARPA, ARP Timeout 04:00:00

Last input never, output 00:27:32, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 101566000 bits/sec, 13900 packets/sec

0 packets input, 0 bytes, 0 no buffer

Received 0 broadcasts (0 multicast)

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored