We have a stack of 6, 48 port 3750 cisco switches and I would like to setup mirroring across the stack to send the data to a network analyser. I have done mirroring before on a single switch, but never on a stack of swtiches. My question is, what sort of things do I need to consider when trying to monitor a stack of c3750 switches with multiple vlans if I want to monitor all of the traffic on all VLANS with my network analyzer?
Since each switch is already stacked, do I only need to setup a single monitor port on one of the switches?
When I specify the port range that I want to monitor, should I just set the source port as being the various vlans I want to monitor, and then set the destination port as being a single port?
switch 1 provision ws-c3750-48ts
switch 2 provision ws-c3750-48ts
switch 3 provision ws-c3750-48ts
switch 4 provision ws-c3750-48ts
switch 5 provision ws-c3750-48p
switch 6 provision ws-c3750-48p
Sorry for asking multiple questions in a single post, I can break it up if needed – it just seems like all of the questions are a part of the overall question regarding configuring SPAN across a switch stack.
Best Answer
A switch stack basically works like a single switch with a single configuration, much like a chassis switch with multiple blades.
You would configure SPAN the same way you do on a single switch. You can set up all the traffic to go to a single monitor port on any of the switches, although you could easily overload the single port and drop a lot of traffic.
For understanding your traffic mix and quantities, NetFlow may be a better solution.