I am trying to setup SPAN on my catalyst 2950 to monitor a specific port in use. The port I want to monitor is #19 and the destination port is #18. Now once I have it setup, when I hook up the monitoring PC to port #18 (the destination port), I can't get the machine to connect to the network either by DHCP or static IP. What am I doing wrong? If I disable the SPAN monitor the machine can then connect to the network. After SPAN is enabled do I have to do something else to the destination port to make it connectable?
The monitoring workstation on port 18 won't be able to get normal access- the switch won't let it, as port 18 is being slammed with all traffic coming in and out of port 19, and therefore cannot interrupt that monitoring to send/receive its own data.
You need to put a second nic in the workstation if you need to get access to it remotely while monitoring.
And with Cisco switches, once you designate a port as the destination port of a SPAN then by definition that is what it is; it won't be able to participate in normal switching operations (such as connecting your PC to the network) while in that stae
thanks for the info. even though the monitoring server couldnt get a connection to the network via that port, when it was connected to the port it was still able to sniff out all the data from that port. if that makes sense. either way i got it to work! SPAN is pretty cool.