WEBVTT

1
00:00.000 --> 00:03.220
So in this video, I'd like to walk you through the configuration and

2
00:03.220 --> 00:06.200
verification of setting up span the original flavor

3
00:06.200 --> 00:09.940
Which means we're gonna do it on the same switch. So as far as our game plan,

4
00:09.940 --> 00:12.640
let's put a quick game plan together for span

5
00:12.640 --> 00:16.160
What I propose we do is let's go ahead and let's pick on

6
00:16.160 --> 00:20.780
Switch to so we use switch to and we're using a single switch with span

7
00:20.780 --> 00:25.200
So as far as the traffic goes let's go ahead and collect data that's coming

8
00:25.200 --> 00:27.340
into or out of gig zero slash one

9
00:27.340 --> 00:30.620
The other option is we could just say if this client for example or this port
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.340 --> 00:30.620
The other option is we could just say if this client for example or this port

10
00:30.620 --> 00:31.380
was in VLAN one

11
00:31.380 --> 00:35.100
We could also say let's go ahead and collect all the packets from VLAN one

12
00:35.100 --> 00:38.390
And if we did that then any traffic going through VLAN one would be part of the

13
00:38.390 --> 00:39.560
source of our capture

14
00:39.560 --> 00:42.940
So for the demo, let's go ahead and use gig zero slash one as our source

15
00:42.940 --> 00:47.100
So we switch to source. It's gonna be gig zero slash one

16
00:47.100 --> 00:50.910
I'll put little double arrow there main traffic going in and out and for the

17
00:50.910 --> 00:53.100
destination even though I don't have it in our

18
00:53.100 --> 00:57.000
Typology, let's go ahead and use port three slash three on this local switch

19
00:57.000 --> 00:57.960
and then be gig of it

20
00:57.960 --> 01:01.740
Ethant three slash three so our destination port would be gig three slash three
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:57.960 --> 01:01.740
Ethant three slash three so our destination port would be gig three slash three

21
01:01.740 --> 01:03.200
then in a production environment

22
01:03.200 --> 01:07.160
We'd place our device there that's collecting those packet captures with a tool

23
01:07.160 --> 01:09.020
like wire shark or some other type of network

24
01:09.020 --> 01:13.270
Management tool to go ahead and take a look at those packets now the syntax to

25
01:13.270 --> 01:14.140
set this up on

26
01:14.140 --> 01:17.220
Switch to is going to use the command monitor

27
01:17.220 --> 01:19.220
So it's going to be monitor space

28
01:19.500 --> 01:22.330
Session and then we can pick a session number. We'll go ahead and start with

29
01:22.330 --> 01:23.140
session number one

30
01:23.140 --> 01:28.020
And then we'd say source interface and this example will use gig zero slash one

31
01:28.020 --> 01:31.860
And we can further specify the direction that we want to collect that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:28.020 --> 01:31.860
And we can further specify the direction that we want to collect that

32
01:31.860 --> 01:34.660
information on meaning traffic going in or traffic going out

33
01:34.660 --> 01:39.640
Or both and then secondly we do the same command monitor session one and then

34
01:39.640 --> 01:41.100
the keyword destination

35
01:41.100 --> 01:43.620
And then we'd say interface for example

36
01:43.820 --> 01:47.350
Gig three slash three if that's where we want the day to go and then we can use

37
01:47.350 --> 01:49.020
some show commands to verify that

38
01:49.020 --> 01:51.820
So without further ado, let me go ahead and walk you through the demonstration

39
01:51.820 --> 01:55.300
of creating span on a single switch with

40
01:55.300 --> 01:58.860
Gig zero one as a source and gig three three as the destination

41
01:58.860 --> 02:03.380
So over to our lab environment we go and let me go ahead and just verify our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:58.860 --> 02:03.380
So over to our lab environment we go and let me go ahead and just verify our

42
02:03.380 --> 02:05.060
topology by double clicking here on the lab

43
02:05.060 --> 02:07.300
Depology and bring that up fantastic

44
02:07.300 --> 02:10.920
I'm going to scootch this down just a little bit and then to get to the console

45
02:10.920 --> 02:12.020
access for our devices

46
02:12.020 --> 02:16.060
We're gonna go ahead and use putty which is running here on server one

47
02:16.060 --> 02:20.060
So we'll double click on server one - nug give that a moment to initialize and

48
02:20.060 --> 02:21.940
here it comes that looks good

49
02:21.940 --> 02:24.380
All right, so here's our console access via putty

50
02:24.380 --> 02:29.500
Let's go ahead and head over to switch to so we go to the tab for switch to and

51
02:29.500 --> 02:30.700
here switch to let's do a show
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:29.500 --> 02:30.700
here switch to let's do a show

52
02:30.700 --> 02:36.210
monitor session and space question mark and let's type in all and currently we

53
02:36.210 --> 02:38.100
have no span configuration present

54
02:38.100 --> 02:41.460
So great. Let's go ahead and create one. So we'll go into configuration mode

55
02:41.460 --> 02:42.900
and based on our plan

56
02:42.900 --> 02:46.890
Let's go ahead and use monitor and session and let's use number one because we

57
02:46.890 --> 02:48.780
're starting out here and we'll say source

58
02:48.780 --> 02:52.470
Then we use the keyword interface that we're tracking an interface instead of a

59
02:52.470 --> 02:53.020
VLAN self

60
02:53.020 --> 02:55.860
We want to track on a VLAN we could use the keyword VLAN instead

61
02:55.860 --> 02:59.440
So based on our plan we want to collect all the traffic that's being seen on

62
02:59.440 --> 03:00.540
interface gig
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:59.440 --> 03:00.540
interface gig

63
03:00.540 --> 03:04.840
And let's take a look at our topology here for a moment on gig zero slash one

64
03:04.840 --> 03:05.900
that leads up to PC 12

65
03:06.140 --> 03:09.920
So we'll type in gig zero slash one space question mark and then we're gonna

66
03:09.920 --> 03:10.900
specify which direction

67
03:10.900 --> 03:13.430
So if we want to receive traffic on the interface or sent traffic on the

68
03:13.430 --> 03:14.260
interface or both

69
03:14.260 --> 03:17.940
We go ahead and specify that so I'm gonna specify both meaning ingress and e

70
03:17.940 --> 03:19.780
gress traffic and boom now

71
03:19.780 --> 03:23.510
We have half of our monitor set up now the second part is where do we want to

72
03:23.510 --> 03:23.820
send it?

73
03:23.820 --> 03:26.700
So if our destination port is gig three slash three

74
03:26.700 --> 03:30.620
That's where our protocol analyzer is with the software to collect that traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
03:26.700 --> 03:30.620
That's where our protocol analyzer is with the software to collect that traffic

75
03:30.620 --> 03:35.030
We type in monitor session same session number and instead of saying source is

76
03:35.030 --> 03:35.980
a destination

77
03:35.980 --> 03:39.980
Then we're gonna specify interface and the interface when I sent it to is gig

78
03:39.980 --> 03:45.540
3/3 and we are done so now we can do a show monitor based question mark and we

79
03:45.540 --> 03:46.180
'll type in all

80
03:46.180 --> 03:48.580
our center and there's our current session

81
03:48.580 --> 03:52.510
So we're collecting data off of zero slash one traffic goes in or out of that

82
03:52.510 --> 03:55.260
interface and we're gonna ship it over to gig

83
03:55.260 --> 03:58.860
3/3 so configuring span on single switch is pretty straightforward

84
03:59.060 --> 04:00.700
We create our monitor session
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:59.060 --> 04:00.700
We create our monitor session

85
04:00.700 --> 04:04.850
We specify where to pick up the data where to mirror or replicate that data to

86
04:04.850 --> 04:05.920
and boom or done

87
04:05.920 --> 04:09.380
So now that we have configured span on a single switch in the next video

88
04:09.380 --> 04:13.080
I'd like to walk you through setting up our span where we're gonna actually be

89
04:13.080 --> 04:14.340
using our span VLAN and

90
04:14.340 --> 04:18.220
Copying the data on one switch and replicating it over to our span VLAN

91
04:18.220 --> 04:21.700
So it can be picked up by the second switch and we'll do that in the next video

92
04:21.700 --> 04:23.700
And I'll see you there in just a moment