CISCO Switch Port Mirroring to Capture Traffic

Network traffic passing through ports can be analyzed by using Switched Port Analyzer (SPAN). This sends a copy of the traffic to another port on the switch that has been connected to a SwitchProbe device, another Remote Monitoring (RMON) probe or security device. SPAN mirrors receive or transmit (or both) traffic on one or more source ports to a destination port for analysis.

To display the details of available interfaces
Switch# show interface status

To display the details of configured vlans
Switch# show vlan

If the switch needs to be accessed over the network, IP address needs to be assigned.

Switch# enable
Switch# configure terminal
Switch(config)# interface vlan 1
Switch(config if)# ip address 192.168.10.1 255.255.255.0
Switch(config if)# no shutdown
Switch(config if)# exit
Switch(config)# exit
Switch#

This example shows how to set up a SPAN session (session 1) for monitoring source port traffic to a destination port.

Check for up and running interfaces of the Switch
Switch# show ip interface brief


Check if any already configured monitoring sessions are available
Switch# show monitor session 1

If any monitoring sessions are available. Need to remove them first. To remove that, switch to configuration mode.
Switch# configure terminal
Switch(config)# no monitor session 1

To configure monitoring sessions. Interface 1/1 to 1/5 is going to be monitored from the interface 1/15.

Switch(config)# monitor session 1 source interface fastEthernet 1/1 - 5
Switch(config)# monitor session 1 destination interface fastEthernet 1/15 encapsulation replicate
Switch(config)# exit

Further you can also configure to monitor traffic on a VLAN traffic. In order to monitor traffic for a particular vlan:

Switch(config)# monitor session 1 source vlan 1

Switch(config)# monitor session 1 destination interface fastEthernet 1/15 encapsulation replicate
Switch(config)# exit

Copy running config to startup config:
Switch# copy running-config startup-config


When a PC, which is running a network traffic capturing solution such as wireshark, connected to interface 1/15, network traffic can be captured.