VSPAN
monitor session 1 source vlan 1 rx
monitor session 1 destination interface Fa0/22
Cat3550 has its limitation of only monitoring traffic received by Vlan. The destination port is at fa0/22. I connected my pc to fa0/22 and turned on wireshark, meanwhile my pc at fa0/21 is pinging to Vlan 1 ip address 10.10.10.1. From the wireshark output Vlan 1 is receiving icmp echo request from 10.10.10.3 (which is the ip address of the pc at port fa0/21).
SPAN
monitor session 1 source interface Fa0/21 both
monitor session 1 destination interface Fa0/22
The default behaviour of SPAN is both direction, if not specified. As you can see whatever is received from fa0/21 and sent to fa0/21 is seen on fa0/22.
Port that is configured as destination port will be removed from vlan list:
Switch#sh vlan brief
VLAN Name Status Ports
—- ——————————– ——— ——————————-
1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4
Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/11, Fa0/12
Fa0/13, Fa0/14, Fa0/15, Fa0/16
Fa0/17, Fa0/18, Fa0/19, Fa0/20
Fa0/21, Fa0/23, Fa0/24, Gi0/1
Gi0/2
10 Production active
20 Guest active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
As you can see fa0/22 is not in vlan 1.
You do not need to assign a static ip address to the wireshark enabled computer at all, all you need to do is to turn on wireshark and connect an ethernet cable to port fa0/22 or other destination port you have configured and see the duplicated copies of data from your source port or source vlan.
cyruslab 