So now on 37 51 the switch that the monitoring station is connected to confetti monitor session.
We want to configure a spend session so we use the session command on do the switch 66 span sessions
could be configured if we wanted to configure span on the twenty nine fifty switch it doesn't support
the same number of sessions on the switch it only supports two sessions the number of active span sessions
however is switch dependent.
Have a look at the documentation of the switch here we'll simply configure session one to keep it simple
we need to specify a source as well as a destination of the span session so the source in our example
will be the LAN one and I want to capture traffic both sent and received in VLAN 1 you need to be careful
spanning a v lan if a lot of traffic is transmitted and received on that VLAN you could oversubscribed
the port as an example of the switch had 24 ports and you spanned all of those ports to this single
interface you would possibly overwhelm this physical interface as another example you don't want to
span a gigabit port to 100 make port and in the same way you need to make sure that your capturing device
can handle the traffic that it's receiving you don't want to as an example forward one gigabits per
second of traffic to P.C. with a slow CPSU that can't capture or handle the amount of traffic that you
throwing at it.
As an analogy we as people may drink water from a gloss or from a tap but generally not from a fire
hydrant because the rate of water that's sent out of a fire hydrant is far more than you can drink.
So don't overload or overwhelm the port as well as the P.C. by sending too much spam traffic out of
this port.
So now monitor session we need to specify the same session no.
And we're going to specify a destination in this case it's going to be a local interface on the switch
fast ethernet 1 0 5 I'll talk about the encapsulation and ingress options in a moment.
For now we're just going to forward the traffic out of the port so do show run pipe include monitor
we configured this command as well as this command on the switch show.
Monitor
we can see that we have one active session it's a local session it's looking at traffic sent and received
on VLAN 1 that's the source destination is Port Fost Ethan at 1 0 5 we're using the native a villain
as the encapsulation ingress traffic is disabled so now on the capturing piece P.S. we'll filter for
ICMP and let's restart that capture
and en route a one all ping routed to and notice we can see the traffic which we weren't able to see
before.
Here is a source ICMP packet from router 1 Notice the MAC address ending in 0 1.
Going to write it to it's a unit cost here the IP addresses a 10 1 1 1 going to 10 1 1 2 it's an echo
request.
Here's the reply It's also a unique cost frame from Rod a 2 to write a 1 unit cost IP addresses it's
a ping reply.
Now if a 1 Telnet to write a 2 and logs in we should be able to see that telnet traffic on the capturing
device and we can so notice as an example he has some telnet information I'll scroll down the rod is
asking for a password he has the password C I S SEO we could also follow the DCP stream
and we'll be able to see the password in this example because we are capturing traffic sent and received
on the V Line.
We're getting some duplicates but as an example if on top enable password show run and look at the running
config of that router if I fall to for telnet traffic again we'll be able to see the line Viti Y and
the password is shown on the line Viti y in the running config of the Rada.
So that's the conflict on the router.
And here it's seen in the wash out capture.
I could once again follow the TCB stream and I'll see the full configuration of the rudder as captured
on the monitoring station.
So what's happening now is when traffic is received or sent on VLAN 1 it's been forwarded out of this
port.
And the capturing device running why shark is able to view the traffic.
So what we did is create a monitoring session monitor session 1 capturing on VLAN 1 and the destination
as fast Ethernet.
1 05 if we remove the monitoring session so do show run pipe include monitor we can see that there's
no output.
In other words the monitoring session has been removed.
Now when we do the capture
and we for instance filter for ICMP traffic and paying a T from Route One we don't see any output.
So no ICMP traffic is shown if we fall to for telnet
and then Telnet to 10 1 1 2.
We don't see anything but if we put to the monitoring session back so monitor session choose a number
one.
And in this case all monitor and interface if one 0 3 which is this interface over here and we'll do
both and then we'll specify a destination of first Ethan at 1 0 5 what we should see now is once that
kicks in as you can see over there we are able to see the Telnet information.
So there's the prompter wrote it too.
And if I scroll up we can see the password.
So the right is asking for a enabled password and he has the password that I typed which is Cisco and
then I pressed into once again if we follow that stream you can see the password that was typed so it's
as simple as that to create a monitoring session it's a show.
Monitor in this example we've got session one which is a local session capturing traffic in and out
of this port and it's going to this destination port 1 0 5 encapsulation is native English traffic is
disabled.
So let's talk about ingress traffic.