So let's have a look at some of the options show monitor session all at the moment.
No spend configuration is present on the system.
We can look at a local span.
We can even look at remote span.
Remote Spanish used where you have a different source and destination switch.
So the source port could be this port on switch to and the destination could be this port on switch
one.
So traffic will be captured on this port and sent to the capturing device on this switch switch one
so I'll configure a monitor session to monitor session pick a number like one source interface fast
ethernet 1 0 1 the destination.
In our example is going to be 1 0 5 seduce show run pipe include monitor that's what we've done.
If we tried to configure a another session using the same destination port of interface if 1 0 5 notice
we told that to that port is already being used.
So we configured this port as the destination of session 1.
We can't now configure it to be the destination for Session 2 but we could as an example configure session
to and specify a different source.
So one zero one as an example.
So do show run pop include monitor.
We've got two sources configured but only one destination.
So show monitor session or we've got session one configured and session to configured but only session
one is configured with a destination port Session 2 is not currently being used.
On one shock device we should be able to capture traffic from Rota one to write it to which we can see
unit cost traffic sent from Rado want to write it to it's being forwarded out of this port because of
this monitoring session traffic sent and received on f 1 slash 1 is going to be sent out of 1 0 5 and
hence we see the ICMP echo request and echo reply messages.
Now there's nothing stopping us moving the destination port from one session to another so we could
put a no in front of that command will now move it to session 2 so that's accepted.
So what we've done now is move the destination port from session one to session to I'll clear that why
shock capture do the ping again and they're just we capturing the traffic because we capturing some
laconic traffic but in a different session.