The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
To configure monitor capture points specifying an attachment point and the packet flow direction or add more attachment points to a capture point, use the monitor capture command in privileged EXEC mode. To disable the monitor capture with the specified attachment point and the packet flow direction or disable one of multiple attachment points on a capture point, use the no form of this command.
monitor capture { capture-name} { interface interface-type interface-id | control-plane} { in | out | both}
no monitor capture { capture-name} { interface interface-type interface-id | control-plane} { in | out | both}
A Wireshark capture is not configured.
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Once an attachment point has been associated with a capture point using this command, the only way to change its direction is to remove the attachment point using the no form of the command and reattach the attachment point with the new direction. An attachment point's direction cannot be overridden.
If an attachment point is removed from a capture point and only one attachment point is associated with it, the capture point is effectively deleted.
Multiple attachment points can be associated with a capture point by re-running this command with another attachment point. An example is provided below.
Multiple capture points can be defined, but only one can be active at a time. In other words, you have to stop one before you can start the other.
Packets captured in the output direction of an interface might not reflect the changes made by switch rewrite (includes TTL, VLAN tag, CoS, checksum, MAC addresses, DSCP, precedent, UP, etc.).
No specific order applies when defining a capture point; you can define capture point parameters in any order. The Wireshark CLI allows as many parameters as possible on a single line. This limits the number of commands required to define a capture point.
Neither VRFs, management ports, nor private VLANs can be used as attachment points.
Wireshark cannot capture packets on a destination SPAN port.
When a VLAN is used as a Wireshark attachment point, packets are captured in the input direction only.
The only form of wireless capture is a CAPWAP tunnel capture.
When capturing CAPWAP tunnels, no other interface types can be used as attachment points on the same capture point.. Also, the only different type of attachment point allowed on the same capture point is the control plane. The combination of control plane and CAPWAP tunnel attachment points should be able to capture all wireless-related traffic.
Capturing multiple CAPWAP tunnels is supported. ACLs for each CAPWAP tunnel will be combined and sent to the switch as a single ACL.
Core filters will not be applied and can be omitted when capturing a CAPWAP tunnel. When control plane and CAPWAP tunnels are mixed, the core filter will not be applied on the control plane packets either.
To capture a CAPWAP non-data tunnel, capture traffic on the management VLAN and apply an appropriate ACL to filter the traffic. Note that this ACL will be combined with the core filter ACL and assigned to the switch as a single ACL.
To define a capture point using a physical interface as an attachment point:
Switch# monitor capture mycap interface GigabitEthernet1/0/1 in Switch# monitor capture mycap match ipv4 any any
![]() Note |
The second command defines the core filter for the capture point. This is required for a functioning capture point unless you are using a CAPWAP tunneling attachment point in your capture point. If you are using CAPWAP tunneling attachment points in your capture point, you cannot use core filters. |
To define a capture point with multiple attachment points:
Switch# monitor capture mycap interface GigabitEthernet1/0/1 in Switch# monitor capture mycap match ipv4 any any Switch# monitor capture mycap control-plane in Switch# show monitor capture mycap parameter monitor capture mycap interface GigabitEthernet1/0/1 in monitor capture mycap control-plane in
To remove an attachment point from a capture point defined with multiple attachment points:
Switch# show monitor capture mycap parameter monitor capture mycap interface GigabitEthernet1/0/1 in monitor capture mycap control-plane in Switch# no monitor capture mycap control-plane Switch# show monitor capture mycap parameter monitor capture mycap interface GigabitEthernet1/0/1 in
To define a capture point with a CAPWAP attachment point:
Switch# show capwap summary CAPWAP Tunnels General Statistics: Number of Capwap Data Tunnels = 1 Number of Capwap Mobility Tunnels = 0 Number of Capwap Multicast Tunnels = 0 Name APName Type PhyPortIf Mode McastIf ------ -------------------------------- ---- --------- --------- ------- Ca0 AP442b.03a9.6715 data Gi3/0/6 unicast - Name SrcIP SrcPort DestIP DstPort DtlsEn MTU Xact ------ --------------- ------- --------------- ------- ------ ----- ---- Ca0 10.10.14.32 5247 10.10.14.2 38514 No 1449 0 Switch# monitor capture mycap interface capwap 0 both Switch# monitor capture mycap file location flash:mycap.pcap Switch# monitor capture mycap file buffer-size 1 Switch# monitor capture mycap start *Aug 20 11:02:21.983: %BUFCAP-6-ENABLE: Capture Point mycap enabled.on Switch# show monitor capture mycap parameter monitor capture mycap interface capwap 0 in monitor capture mycap interface capwap 0 out monitor capture mycap file location flash:mycap.pcap buffer-size 1 Switch# Switch# show monitor capture mycap Status Information for Capture mycap Target Type: Interface: CAPWAP, Ingress: 0 Egress: 0 Status : Active Filter Details: Capture all packets Buffer Details: Buffer Type: LINEAR (default) File Details: Associated file name: flash:mycap.pcap Size of buffer(in MB): 1 Limit Details: Number of Packets to capture: 0 (no limit) Packet Capture duration: 0 (no limit) Packet Size to capture: 0 (no limit) Packets per second: 0 (no limit) Packet sampling rate: 0 (no sampling) Switch# Switch# show monitor capture file flash:mycap.pcap 1 0.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 2 0.499974 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 3 2.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 4 2.499974 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 5 3.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 6 4.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 7 4.499974 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 8 5.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 9 5.499974 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 10 6.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 11 8.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 12 9.225986 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 13 9.225986 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 14 9.225986 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 15 9.231998 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 16 9.231998 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 17 9.231998 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 18 9.236987 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 19 10.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 20 10.499974 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 21 12.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 22 12.239993 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 23 12.244997 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 24 12.244997 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 25 12.250994 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 26 12.256990 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 27 12.262987 10.10.14.2 -> 10.10.14.32 DTLSv1.0 Application Data 28 12.499974 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........ 29 12.802012 10.10.14.3 -> 10.10.14.255 NBNS Name query NB WPAD.<00> 30 13.000000 00:00:00:00:00:00 -> 3c:ce:73:39:c6:60 IEEE 802.11 Probe Request, SN=0, FN=0, Flags=........
Command |
Description |
Configures the buffer for monitor capture (WireShark). |
|
Configures monitor capture (WireShark) storage file attributes. |
|
show monitor capture |
To configure the buffer for monitor capture (WireShark), use the monitor capture buffer command in privileged EXEC mode. To disable the monitor capture buffer or change the buffer back to a default linear buffer from a circular buffer, use the no form of this command.
monitor capture { capture-name} buffer { circular [ size buffer-size ] | size buffer-size}
no monitor capture { capture-name} buffer [ circular ]
capture-name | The name of the capture whose buffer is to be configured. |
circular | Specifies that the buffer is of a circular type. The circular type of buffer continues to capture data, even after the buffer is consumed, by overwriting the data captured previously. |
size buffer-size | (Optional) Specifies the size of the buffer. The range is from 1 MB to 100 MB. |
A linear buffer is configured.
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
When you first configure a WireShark capture, a circular buffer of a small size is suggested.
To configure a circular buffer with a size of 1 MB:
Switch# monitor capture mycap buffer circular size 1
Command |
Description |
Configures monitor capture (WireShark) specifying an attachment point and the packet flow direction. |
|
Configures monitor capture (WireShark) storage file attributes. |
|
show monitor capture |
To clears the monitor capture (WireShark) buffer, use the monitor capture clear command in privileged EXEC mode.
monitor capture { capture-name} clear
capture-name | The name of the capture whose buffer is to be cleared. |
The buffer content is not cleared.
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Use the monitor capture clear command either during capture or after the capture has stopped either because one or more end conditions has been met, or you entered the monitor capture stop command. If you enter the monitor capture clear command after the capture has stopped, the monitor capture export command that is used to store the contents of the captured packets in a file will have no impact because the buffer has no captured packets.
If you have more than one capture that is storing packets in a buffer, clear the buffer before starting a new capture to avoid memory loss.
To clear the buffer contents for capture mycap:
Switch# monitor capture mycap clear
To export a monitor capture (WireShark) to a file, use the monitor capture export command in privileged EXEC mode.
monitor capture { capture-name} export file-location : file-name
capture-name | The name of the capture to be exported. |
file-location : file-name |
|
The captured packets are not stored.
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Use the monitor capture export command only when the storage destination is a capture buffer. The file may be stored either remotely or locally. Use this command either during capture or after the packet capture has stopped. The packet capture is stopped when one or more end conditions have been met or you entered the monitor capture stop command.
![]() Note |
Attempts to store packet captures on unsupported devices or devices not connected to the active switch will probably result in errors. |
To export the capture buffer contents to mycap.pcap on a flash drive:
Switch# monitor capture mycap export flash:mycap.pcap
To configure monitor capture (WireShark) storage file attributes, use the monitor capture file command in privileged EXEC mode. To remove a storage file attribute, use the no form of this command.
monitor capture { capture-name} file{ [ buffer-size temp-buffer-size ] [ location file-location : file-name ] [ ring number-of-ring-files ] [ size total-size ] }
no monitor capture { capture-name} file{ [ buffer-size ] [ location ] [ ring ] [ size ] }
capture-name | The name of the capture to be modified. |
buffer-size temp-buffer-size | (Optional) Specifies the size of the temporary buffer. The range for temp-buffer-size is 1 to 100 MB. This is specified to reduce packet loss. |
location file-location : file-name |
|
ring number-of-ring-files | (Optional) Specifies that the capture is to be stored in a circular file chain and the number of files in the file ring. |
size total-size | (Optional) Specifies the total size of the capture files. |
None
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Use the monitor capture file command only when the storage destination is a file. The file may be stored either remotely or locally. Use this command after the packet capture has stopped. The packet capture is stopped when one or more end conditions have been met or you entered the monitor capture stop command.
![]() Note |
Attempts to store packet captures on unsupported devices or devices not connected to the active switch will probably result in errors. |
To specify that the storage file name is mycap.pcap, stored on a flash drive:
Switch# monitor capture mycap file location flash:mycap.pcap
Command |
Description |
Configures monitor capture (WireShark) specifying an attachment point and the packet flow direction. |
|
Configures the buffer for monitor capture (WireShark). |
|
show monitor capture |
To configure capture limits, use the monitor capture limit command in privileged EXEC mode. To remove the capture limits, use the no form of this command.
monitor capture { capture-name} limit { [ duration seconds] [ packet-length size] [ packets num] }
no monitor capture { capture-name} limit [ duration] [ packet-length] [ packets]
capture-name | The name of the capture to be assigned capture limits. |
duration seconds | (Optional) Specifies the duration of the capture, in seconds. The range is from 1 to 1000000. |
packet-length size | (Optional) Specifies the packet length, in bytes. If the actual packet is longer than the specified length, only the first set of bytes whose number is denoted by the bytes argument is stored. |
packets num | (Optional) Specifies the number of packets to be processed for capture. |
Capture limits are not configured.
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
To configure a session limit of 60 seconds and a packet segment length of 400 bytes:
Switch# monitor capture mycap limit duration 60 packet-len 400
![]() Note |
Do not use this command when capturing a CAPWAP tunnel. Also, when control plane and CAPWAP tunnels are mixed, this command will have no effect. |
To define an explicit inline core filter for a monitor (Wireshark) capture, use the monitor capture match command in privileged EXEC mode. To remove this filter, use the no form of this command.
monitor capture { capture-name} match { any | mac mac-match-string | ipv4 { any | host | protocol} { any | host} | ipv6 { any | host | protocol} { any | host} }
no monitor capture { capture-name} match
capture-name | The name of the capture to be assigned a core filter. |
any | Specifies all packets. |
mac mac-match-string | Specifies a Layer 2 packet. |
ipv4 | Specifies IPv4 packets. |
host | Specifies the host. |
protocol | Specifies the protocol. |
ipv6 | Specifies IPv6 packets. |
A core filter is not configured.
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
To define a capture point and the core filter for the capture point that matches to any IP version 4 packets on the source or destination:
Switch# monitor capture mycap interface GigabitEthernet1/0/1 in Switch# monitor capture mycap match ipv4 any any
To start the capture of packet data at a traffic trace point into a buffer, use the monitor capture start command in privileged EXEC mode.
monitor capture { capture-name} start
capture-name | The name of the capture to be started. |
The buffer content is not cleared.
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Use the monitor capture clear command to enable the packet data capture after the capture point is defined. To stop the capture of packet data, use the monitor capture stop command.
Ensure that system resources such as CPU and memory are available before starting a capture.
To start capturing buffer contents:
Switch# monitor capture mycap start
To stop the capture of packet data at a traffic trace point, use the monitor capture stop command in privileged EXEC mode.
monitor capture { capture-name} stop
capture-name | The name of the capture to be stopped. |
The packet data capture is ongoing.
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Use the monitor capture stop command to stop the capture of packet data that you started using the monitor capture start command. You can configure two types of capture buffers: linear and circular. When the linear buffer is full, data capture stops automatically. When the circular buffer is full, data capture starts from the beginning and the data is overwritten.
To stop capturing buffer contents:
Switch# monitor capture mycap stop
To create a new Ethernet Switched Port Analyzer (SPAN) or a Remote Switched Port Analyzer (RSPAN) session configuration for analyzing traffic between ports or add to an existing session configuration, use the monitor session global configuration command. To clear SPAN or RSPAN sessions, use the no form of this command.
monitor session session-number { destination | filter | source}
no monitor session { session-number [ destination | filter | source] | all | local | range session-range | remote}
Clears all local monitor sessions. |
|
range session-range |
Clears monitor sessions in the specified range. |
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
You can verify your settings by entering the show monitor privileged EXEC command. You can display SPAN, RSPAN, FSPAN, and FRSPAN configuration on the switch by entering the show running-config privileged EXEC command. SPAN information appears near the end of the output.
This example shows how to create a local SPAN session 1 to monitor traffic on Po13 (an EtherChannel port) and limit SPAN traffic in the session only to VLAN 1281. Egress traffic replicates the source; ingress forwarding is not enabled.
Switch(config)# monitor session 1 source interface Po13 Switch(config)# monitor session 1 filter vlan 1281 Switch(config)# monitor session 1 destination interface GigabitEthernet2/0/36 encapsulation replicate Switch(config)# monitor session 1 destination interface GigabitEthernet3/0/36 encapsulation replicate
The following is the output of a show monitor session all command after completing these setup instructions:
Switch# show monitor session all
Session 1
---------
Type : Local Session
Source Ports :
Both : Po13
Destination Ports : Gi2/0/36,Gi3/0/36
Encapsulation : Replicate
Ingress : Disabled
Filter VLANs : 1281
...
Command |
Description |
Configures a FSPAN or FRSPAN destination session. |
|
Configures a FSPAN or FRSPAN session filter. |
|
Configures a FSPAN or FRSPAN source session. |
|
Displays information about all SPAN and RSPAN sessions. |
To start a new Switched Port Analyzer (SPAN) session or Remote SPAN (RSPAN) destination session, to enable ingress traffic on the destination port for a network security device (such as a Cisco IDS Sensor Appliance), and to add or delete interfaces or VLANs to or from an existing SPAN or RSPAN session, use the monitor session destination global configuration command. To remove the SPAN or RSPAN session or to remove destination interfaces from the SPAN or RSPAN session, use the no form of this command.
monitor session session-number destination { interface interface-id [ , | -] [ encapsulation { replicate | dot1q} ] { ingress [ dot1q | untagged] } | { remote} vlan vlan-id
no monitor session session-number destination { interface interface-id [ , | -] [ encapsulation { replicate | dot1q} ] { ingress [ dot1q | untagged] } | { remote} vlan vlan-id
Specifies the destination or source interface for a SPAN or RSPAN session. Valid interfaces are physical ports (including type, stack member, module, and port number). For source interface, port channel is also a valid interface type, and the valid range is 1 to 128. |
|
, |
(Optional) Specifies a series of interfaces or VLANs, or separates a range of interfaces or VLANs from a previous range. Enter a space before and after the comma. |
- |
(Optional) Specifies a range of interfaces or VLANs. Enter a space before and after the hyphen. |
(Optional) Specifies that the destination interface replicates the source interface encapsulation method. If not selected, the default is to send packets in native form (untagged). These keywords are valid only for local SPAN. For RSPAN, the RSPAN VLAN ID overwrites the original VLAN ID; therefore, packets are always sent untagged. The encapsulation options are ignored with the no form of the command. |
|
encapsulation dot1q |
(Optional) Specifies that the destination interface accepts the source interface incoming packets with IEEE 802.1Q encapsulation. These keywords are valid only for local SPAN. For RSPAN, the RSPAN VLAN ID overwrites the original VLAN ID; therefore, packets are always sent untagged. The encapsulation options are ignored with the no form of the command. |
(Optional) Accepts incoming packets with IEEE 802.1Q encapsulation with the specified VLAN as the default VLAN. |
|
untagged |
(Optional) Accepts incoming packets with untagged encapsulation with the specified VLAN as the default VLAN. |
remote |
Specifies the remote VLAN for an RSPAN source or destination session. The range is 2 to 1001 and 1006 to 4094. The RSPAN VLAN cannot be VLAN 1 (the default VLAN) or VLAN IDs 1002 to 1005 (reserved for Token Ring and FDDI VLANs). |
Sets the default VLAN for ingress traffic when used with only the ingress keyword. |
No monitor sessions are configured.
If encapsulation replicate is not specified on a local SPAN destination port, packets are sent in native form with no encapsulation tag.
Ingress forwarding is disabled on destination ports.
You can specify all, local, range session-range, or remote with the no monitor session command to clear all SPAN and RSPAN, all local SPAN, a range, or all RSPAN sessions.
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
You can set a combined maximum of 8 local SPAN sessions and RSPAN source sessions. You can have a total of 66 SPAN and RSPAN sessions on a switch or switch stack.
A SPAN or RSPAN destination must be a physical port.
You can have a maximum of 64 destination ports on a switch or a switch stack.
Each session can include multiple ingress or egress source ports or VLANs, but you cannot combine source ports and source VLANs in a single session. Each session can include multiple destination ports.
When you use VLAN-based SPAN (VSPAN) to analyze network traffic in a VLAN or set of VLANs, all active ports in the source VLANs become source ports for the SPAN or RSPAN session. Trunk ports are included as source ports for VSPAN, and only packets with the monitored VLAN ID are sent to the destination port.
You can monitor traffic on a single port or VLAN or on a series or range of ports or VLANs. You select a series or range of interfaces or VLANs by using the [ , | -] options.
If you specify a series of VLANs or interfaces, you must enter a space before and after the comma. If you specify a range of VLANs or interfaces, you must enter a space before and after the hyphen ( -).
EtherChannel ports can be configured as SPAN or RSPAN destination ports. A physical port that is a member of an EtherChannel group can be used as a destination port, but it cannot participate in the EtherChannel group while it is as a SPAN destination.
A port used as a destination port cannot be a SPAN or RSPAN source, nor can a port be a destination port for more than one session at a time.
You can enable IEEE 802.1x authentication on a port that is a SPAN or RSPAN destination port; however, IEEE 802.1x authentication is disabled until the port is removed as a SPAN destination. If IEEE 802.1x authentication is not available on the port, the switch returns an error message. You can enable IEEE 802.1x authentication on a SPAN or RSPAN source port.
If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic at Layer 2.
Destination ports can be configured to function in these ways:
You can verify your settings by entering the show monitor privileged EXEC command. You can display SPAN, RSPAN, FSPAN, and FRSPAN configuration on the switch by entering the show running-config privileged EXEC command. SPAN information appears near the end of the output.
This example shows how to create a local SPAN session 1 to monitor both sent and received traffic on source port 1 on stack member 1 to destination port 2 on stack member 2:
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 both Switch(config)# monitor session 1 destination interface gigabitethernet1/0/2
This example shows how to delete a destination port from an existing local SPAN session:
Switch(config)# no monitor session 2 destination interface gigabitethernet1/0/2
This example shows how to configure RSPAN source session 1 to monitor a source interface and to configure the destination RSPAN VLAN 900:
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 Switch(config)# monitor session 1 destination remote vlan 900 Switch(config)# end
This example shows how to configure an RSPAN destination session 10 in the switch receiving the monitored traffic:
Switch(config)# monitor session 10 source remote vlan 900 Switch(config)# monitor session 10 destination interface gigabitethernet1/0/2
This example shows how to configure the destination port for ingress traffic on VLAN 5 by using a security device that supports IEEE 802.1Q encapsulation. Egress traffic replicates the source; ingress traffic uses IEEE 802.1Q encapsulation.
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 encapsulation dot1q ingress dot1q vlan 5
This example shows how to configure the destination port for ingress traffic on VLAN 5 by using a security device that does not support encapsulation. Egress traffic and ingress traffic are untagged.
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 ingress untagged vlan 5
Command |
Description |
Configures a new SPAN or RSPAN session. |
|
Configures a FSPAN or FRSPAN session filter. |
|
Configures a FSPAN or FRSPAN source session. |
|
Displays information about all SPAN and RSPAN sessions. |
To start a new flow-based SPAN (FSPAN) session or flow-based RSPAN (FRSPAN) source or destination session, or to limit (filter) SPAN source traffic to specific VLANs, use the monitor session filter global configuration command. To remove filters from the SPAN or RSPAN session, use the no form of this command.
monitor session session-number filter { vlan vlan-id [ , | -] }
no monitor session session-number filter { vlan vlan-id [ , | -] }
Specifies a list of VLANs as filters on trunk source ports to limit SPAN source traffic to specific VLANs. The vlan-id range is 1 to 4094. |
|
(Optional) Specifies a series of VLANs, or separates a range of VLANs from a previous range. Enter a space before and after the comma. |
|
(Optional) Specifies a range of VLANs. Enter a space before and after the hyphen. |
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
You can monitor traffic on a single VLAN or on a series or range of ports or VLANs. You select a series or range of VLANs by using the [ , | -] options.
If you specify a series of VLANs, you must enter a space before and after the comma. If you specify a range of VLANs, you must enter a space before and after the hyphen ( -).
VLAN filtering refers to analyzing network traffic on a selected set of VLANs on trunk source ports. By default, all VLANs are monitored on trunk source ports. You can use the monitor session session_number filter vlan vlan-id command to limit SPAN traffic on trunk source ports to only the specified VLANs.
VLAN monitoring and VLAN filtering are mutually exclusive. If a VLAN is a source, VLAN filtering cannot be enabled. If VLAN filtering is configured, a VLAN cannot become a source.
You can verify your settings by entering the show monitor privileged EXEC command. You can display SPAN, RSPAN, FSPAN, and FRSPAN configuration on the switch by entering the show running-config privileged EXEC command. SPAN information appears near the end of the output.
This example shows how to limit SPAN traffic in an existing session only to specific VLANs:
Switch(config)# monitor session 1 filter vlan 100 - 110
This example shows how to create a local SPAN session 1 to monitor both sent and received traffic on source port 1 on stack member 1 to destination port 2 on stack member 2 and to filter IPv4 traffic using access list number 122 in an FSPAN session:
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 both Switch(config)# monitor session 1 destination interface gigabitethernet1/0/2 Switch(config)# monitor session 1 filter ip access-group 122
Command |
Description |
Configures a new SPAN or RSPAN session. |
|
Configures a FSPAN or FRSPAN destination session. |
|
Configures a FSPAN or FRSPAN source session. |
|
Displays information about all SPAN and RSPAN sessions. |
To start a new Switched Port Analyzer (SPAN) session or Remote SPAN (RSPAN) source session, or to add or delete interfaces or VLANs to or from an existing SPAN or RSPAN session, use the monitor session source global configuration command. To remove the SPAN or RSPAN session or to remove source interfaces from the SPAN or RSPAN session, use the no form of this command.
monitor session session_number source { interface interface-id [ , | -] [ both | rx | tx] | [ remote] vlan vlan-id [ , | -] [ both | rx | tx]}
no monitor session session_number source { interface interface-id [ , | -] [ both | rx | tx] | [ remote] vlan vlan-id [ , | -] [ both | rx | tx]}
Specifies the source interface for a SPAN or RSPAN session. Valid interfaces are physical ports (including type, stack member, module, and port number). For source interface, port channel is also a valid interface type, and the valid range is 1 to 48. |
|
(Optional) Specifies a series of interfaces or VLANs, or separates a range of interfaces or VLANs from a previous range. Enter a space before and after the comma. |
|
(Optional) Specifies a range of interfaces or VLANs. Enter a space before and after the hyphen. |
|
(Optional) Specifies the traffic direction to monitor. If you do not specify a traffic direction, the source interface sends both transmitted and received traffic. |
|
(Optional) Specifies the remote VLAN for an RSPAN source or destination session. The range is 2 to 1001 and 1006 to 4094. The RSPAN VLAN cannot be VLAN 1 (the default VLAN) or VLAN IDs 1002 to 1005 (reserved for Token Ring and FDDI VLANs). |
|
vlan vlan-id |
When used with only the ingress keyword, sets default VLAN for ingress traffic. |
No monitor sessions are configured.
On a source interface, the default is to monitor both received and transmitted traffic.
On a trunk interface used as a source port, all VLANs are monitored.
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Traffic that enters or leaves source ports or source VLANs can be monitored by using SPAN or RSPAN. Traffic routed to source ports or source VLANs cannot be monitored.
A source can be a physical port, a port channel, or a VLAN.
Each session can include multiple ingress or egress source ports or VLANs, but you cannot combine source ports and source VLANs in a single session. Each session can include multiple destination ports.
When you use VLAN-based SPAN (VSPAN) to analyze network traffic in a VLAN or set of VLANs, all active ports in the source VLANs become source ports for the SPAN or RSPAN session. Trunk ports are included as source ports for VSPAN, and only packets with the monitored VLAN ID are sent to the destination port.
You can monitor traffic on a single port or VLAN or on a series or range of ports or VLANs. You select a series or range of interfaces or VLANs by using the [ , | -] options.
If you specify a series of VLANs or interfaces, you must enter a space before and after the comma. If you specify a range of VLANs or interfaces, you must enter a space before and after the hyphen ( -).
You can monitor individual ports while they participate in an EtherChannel, or you can monitor the entire EtherChannel bundle by specifying the port-channel number as the RSPAN source interface.
A port used as a destination port cannot be a SPAN or RSPAN source, nor can a port be a destination port for more than one session at a time.
You can enable IEEE 802.1x authentication on a SPAN or RSPAN source port.
You can verify your settings by entering the show monitor privileged EXEC command. You can display SPAN, RSPAN, FSPAN, and FRSPAN configuration on the switch by entering the show running-config privileged EXEC command. SPAN information appears near the end of the output.
This example shows how to create a local SPAN session 1 to monitor both sent and received traffic on source port 1 on stack member 1 to destination port 2 on stack member 2:
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 both Switch(config)# monitor session 1 destination interface gigabitethernet1/0/2
This example shows how to configure RSPAN source session 1 to monitor multiple source interfaces and to configure the destination RSPAN VLAN 900.
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 Switch(config)# monitor session 1 source interface port-channel 2 tx Switch(config)# monitor session 1 destination remote vlan 900 Switch(config)# end
Command |
Description |
Configures a new SPAN or RSPAN session. |
|
Configures a FSPAN or FRSPAN destination session. |
|
Configures a FSPAN or FRSPAN session filter. |
|
Displays information about all SPAN and RSPAN sessions. |
To display information about all Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) sessions, use the show monitor command in EXEC mode.
show monitor [ session { session_number | all | local | range list | remote} [ detail]]
(Optional) Displays information about specified SPAN sessions. |
|||
(Optional) Displays a range of SPAN sessions, where list is the range of valid sessions. The range is either a single session or a range of sessions described by two numbers, the lower one first, separated by a hyphen. Do not enter any spaces between comma-separated parameters or in hyphen-specified ranges.
|
|||
(Optional) Displays detailed information about the specified sessions. |
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
The output is the same for the show monitor command and the show monitor session all command.
This is an example of output for the show monitor user EXEC command:
Switch# show monitor Session 1 --------- Type : Local Session Source Ports : RX Only : Gi4/0/1 Both : Gi4/0/2-3,Gi4/0/5-6 Destination Ports : Gi4/0/20 Encapsulation : Replicate Ingress : Disabled Session 2 --------- Type : Remote Source Session Source VLANs : TX Only : 10 Both : 1-9 Dest RSPAN VLAN : 105
This is an example of output for the show monitor user EXEC command for local SPAN source session 1:
Switch# show monitor session 1 Session 1 --------- Type : Local Session Source Ports : RX Only : Gi4/0/1 Both : Gi4/0/2-3,Gi4/0/5-6 Destination Ports : Gi4/0/20 Encapsulation : Replicate Ingress : Disabled
This is an example of output for the show monitor session all user EXEC command when ingress traffic forwarding is enabled:
Switch# show monitor session all Session 1 --------- Type : Local Session Source Ports : Both : Gi4/0/2 Destination Ports : Gi4/0/3 Encapsulation : Native Ingress : Enabled, default VLAN = 5 Ingress encap : DOT1Q Session 2 --------- Type : Local Session Source Ports : Both : Gi4/0/8 Destination Ports : Gi4/012 Encapsulation : Replicate Ingress : Enabled, default VLAN = 4 Ingress encap : Untagged
Command |
Description |
Configures a new SPAN or RSPAN session. |
|
Configures a FSPAN or FRSPAN destination session. |
|
Configures a FSPAN or FRSPAN session filter. |
|
Configures a FSPAN or FRSPAN source session. |
To display monitor capture (WireShark) content, use the show monitor capture file command in privileged EXEC mode.
show monitor capture [ capture-name [ buffer ] | file file-location : file-name ] [ brief | detailed | display-filter display-filter-string ]
capture-name | (Optional) Specifies the name of the capture to be displayed. |
buffer | (Optional) Specifies that a buffer associated with the named capture is to be displayed. |
file file-location : file-name | (Optional) Specifies the file location and name of the capture storage file to be displayed. |
brief | (Optional) Specifies the display content in brief. |
detailed | (Optional) Specifies detailed display content. |
display-filter display-filter-string | Filters the display content according to the display-filter-string. |
Displays all capture content.
Privileged EXEC
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
none
To display the capture for a capture called mycap:
Switch# show monitor capture mycap
Status Information for Capture mycap
Target Type:
Interface: CAPWAP,
Ingress:
0
Egress:
0
Status : Active
Filter Details:
Capture all packets
Buffer Details:
Buffer Type: LINEAR (default)
File Details:
Associated file name: flash:mycap.pcap
Size of buffer(in MB): 1
Limit Details:
Number of Packets to capture: 0 (no limit)
Packet Capture duration: 0 (no limit)
Packet Size to capture: 0 (no limit)
Packets per second: 0 (no limit)
Packet sampling rate: 0 (no sampling)
Command |
Description |
Configures monitor capture (WireShark) specifying an attachment point and the packet flow direction. |
|
Configures the buffer for monitor capture (WireShark). |
|
Configures monitor capture (WireShark) storage file attributes. |
To enable the switch to send Simple Network Management Protocol (SNMP) notifications for various traps or inform requests to the network management system (NMS), use the snmp-server enable traps command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps [ auth-framework [ sec-violation] | bridge | call-home | cluster | config | config-copy | config-ctid | copy-config | cpu | dot1x | energywise | entity | envmon | errdisable | event-manager | flash | fru-ctrl | license | mac-notification | port-security | power-ethernet | rep | snmp | stackwise | storm-control | stpx | syslog | transceiver | tty | vlan-membership | vlancreate | vlandelete | vstack | vtp ]
no snmp-server enable traps [ auth-framework [ sec-violation] | bridge | call-home | cluster | config | config-copy | config-ctid | copy-config | cpu | dot1x | energywise | entity | envmon | errdisable | event-manager | flash | fru-ctrl | license | mac-notification | port-security | power-ethernet | rep | snmp | stackwise | storm-control | stpx | syslog | transceiver | tty | vlan-membership | vlancreate | vlandelete | vstack | vtp ]
auth-framework |
(Optional) Enables SNMP CISCO-AUTH-FRAMEWORK-MIB traps. |
sec-violation |
(Optional) Enables SNMP camSecurityViolationNotif notifications. |
bridge |
(Optional) Enables SNMP STP Bridge MIB traps.* |
call-home |
(Optional) Enables SNMP CISCO-CALLHOME-MIB traps.* |
cluster |
(Optional) Enables SNMP cluster traps. |
config |
(Optional) Enables SNMP configuration traps. |
config-copy |
(Optional) Enables SNMP configuration copy traps. |
config-ctid |
(Optional) Enables SNMP configuration CTID traps. |
copy-config |
(Optional) Enables SNMP copy-configuration traps. |
cpu |
(Optional) Enables CPU notification traps.* |
dot1x |
(Optional) Enables SNMP dot1x traps.* |
energywise |
(Optional) Enables SNMP energywise traps.* |
entity |
(Optional) Enables SNMP entity traps. |
envmon |
(Optional) Enables SNMP environmental monitor traps.* |
errdisable |
(Optional) Enables SNMP errdisable notification traps.* |
event-manager |
(Optional) Enables SNMP Embedded Event Manager traps. |
flash |
(Optional) Enables SNMP FLASH notification traps.* |
fru-ctrl |
(Optional) Generates entity field-replaceable unit (FRU) control traps. In a switch stack, this trap refers to the insertion or removal of a switch in the stack. |
license |
(Optional) Enables license traps.* |
mac-notification |
(Optional) Enables SNMP MAC Notification traps.* |
port-security |
(Optional) Enables SNMP port security traps.* |
power-ethernet |
(Optional) Enables SNMP power Ethernet traps.* |
rep |
(Optional) Enables SNMP Resilient Ethernet Protocol traps. |
snmp |
(Optional) Enables SNMP traps.* |
stackwise |
(Optional) Enables SNMP stackwise traps.* |
storm-control |
(Optional) Enables SNMP storm-control trap parameters.* |
stpx |
(Optional) Enables SNMP STPX MIB traps.* |
syslog |
(Optional) Enables SNMP syslog traps. |
transceiver |
(Optional) Enables SNMP transceiver traps.* |
tty |
(Optional) Sends TCP connection traps. This is enabled by default. |
vlan-membership |
(Optional) Enables SNMP VLAN membership traps. |
vlancreate |
(Optional) Enables SNMP VLAN-created traps. |
vlandelete |
(Optional) Enables SNMP VLAN-deleted traps. |
vstack |
(Optional) Enables SNMP Smart Install traps.* |
vtp |
(Optional) Enables VLAN Trunking Protocol (VTP) traps. |
The sending of SNMP traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
The command options marked with an asterisk in the table above have subcommands. For more information on these subcommands, see the Related Commands section below.
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
When supported, use the snmp-server enable traps command to enable sending of traps or informs.
![]() Note |
Though visible in the command-line help strings, the fru-ctrl, insertion, and removal keywords are not supported on the switch. The snmp-server enable informs global configuration command is not supported. To enable the sending of SNMP inform notifications, use the snmp-server enable traps global configuration command combined with the snmp-server host host-addr informs global configuration command. |
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to enable more than one type of SNMP trap:
Switch(config)# snmp-server enable traps cluster Switch(config)# snmp-server enable traps config Switch(config)# snmp-server enable traps vtp
Command |
Description |
Generates STP bridge MIB traps. |
|
Enables SNMP CISCO-CALLHOME-MIB traps. |
|
Enables CPU notifications. |
|
Enables SNMP environmental traps. |
|
Enables SNMP errdisable notifications. |
|
Enables SNMP flash notifications. |
|
Enables license traps. |
|
Enables SNMP MAC notification traps. |
|
Enables SNMP port security traps. |
|
Enables SNMP PoE traps. |
|
Enables SNMP traps. |
|
Enables SNMP StackWise traps. |
|
Enables SNMP storm-control trap parameters. |
|
Enables SNMP STPX MIB traps. |
|
Enable SNMP transceiver traps. |
|
Enables SNMP smart install traps. |
|
Specifies the recipient (host) of a SNMP notification operation. |
To generate STP bridge MIB traps, use the snmp-server enable traps bridge command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps bridge [ newroot] [ topologychange]
no snmp-server enable traps bridge [ newroot] [ topologychange]
newroot |
(Optional) Enables SNMP STP bridge MIB new root traps. |
topologychange |
(Optional) Enables SNMP STP bridge MIB topology change traps. |
The sending of bridge SNMP traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to send bridge new root traps to the NMS:
Switch(config)# snmp-server enable traps bridge newroot
To enable SNMP CISCO-CALLHOME-MIB traps, use the snmp-server enable traps call-home command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps call-home [ message-send-fail | server-fail]
no snmp-server enable traps call-home [ message-send-fail | server-fail]
message-send-fail |
(Optional) Enables SNMP message-send-fail traps. |
server-fail |
(Optional) Enables SNMP server-fail traps. |
The sending of SNMP CISCO-CALLHOME-MIB traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to generate SNMP message-send-fail traps:
Switch(config)# snmp-server enable traps call-home message-send-fail
To enable CPU notifications, use the snmp-server enable traps cpu command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps cpu [ threshold]
no snmp-server enable traps cpu [ threshold]
threshold |
(Optional) Enables CPU threshold notification. |
The sending of CPU notifications is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to generate CPU threshold notifications:
Switch(config)# snmp-server enable traps cpu threshold
To enable SNMP environmental traps, use the snmp-server enable traps envmon command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps envmon [ fan] [ shutdown] [ status] [ supply] [ temperature]
no snmp-server enable traps envmon [ fan] [ shutdown] [ status] [ supply] [ temperature]
fan |
(Optional) Enables fan traps. |
shutdown |
(Optional) Enables environmental monitor shutdown traps. |
status |
(Optional) Enables SNMP environmental status-change traps. |
supply |
(Optional) Enables environmental monitor power-supply traps. |
temperature |
(Optional) Enables environmental monitor temperature traps. |
The sending of environmental SNMP traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to generate fan traps:
Switch(config)# snmp-server enable traps envmon fan
To enable SNMP notifications of error-disabling, use the snmp-server enable traps errdisable command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps errdisable [ notification-rate number-of-notifications]
no snmp-server enable traps errdisable [ notification-rate number-of-notifications]
notification-rate number-of-notifications |
(Optional) Specifies number of notifications per minute as the notification rate. Accepted values are from 0 to 10000. |
The sending of SNMP notifications of error-disabling is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to set the number SNMP notifications of error-disabling to 2:
Switch(config)# snmp-server enable traps errdisable notification-rate 2
To enable SNMP flash notifications, use the snmp-server enable traps flash command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps flash [ insertion] [ removal]
no snmp-server enable traps flash [ insertion] [ removal]
insertion |
(Optional) Enables SNMP flash insertion notifications. |
removal |
(Optional) Enables SNMP flash removal notifications. |
The sending of SNMP flash notifications is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to generate SNMP flash insertion notifications:
Switch(config)# snmp-server enable traps flash insertion
To enable license traps, use the snmp-server enable traps license command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps license [ deploy] [ error] [ usage]
no snmp-server enable traps license [ deploy] [ error] [ usage]
deploy |
(Optional) Enables license deployment traps. |
error |
(Optional) Enables license error traps. |
usage |
(Optional) Enables license usage traps. |
The sending of license traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to generate license deployment traps:
Switch(config)# snmp-server enable traps license deploy
To enable SNMP MAC notification traps, use the snmp-server enable traps mac-notification command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps mac-notification [ change] [ move] [ threshold]
no snmp-server enable traps mac-notification [ change] [ move] [ threshold]
change |
(Optional) Enables SNMP MAC change traps. |
move |
(Optional) Enables SNMP MAC move traps. |
threshold |
(Optional) Enables SNMP MAC threshold traps. |
The sending of SNMP MAC notification traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to generate SNMP MAC notification change traps:
Switch(config)# snmp-server enable traps mac-notification change
To enable SNMP port security traps, use the snmp-server enable traps port-security command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps port-security [ trap-rate value]
no snmp-server enable traps port-security [ trap-rate value]
trap-rate value |
(Optional) Sets the maximum number of port-security traps sent per second. The range is from 0 to 1000; the default is 0 (no limit imposed; a trap is sent at every occurrence). |
The sending of port security SNMP traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to enable port-security traps at a rate of 200 per second:
Switch(config)# snmp-server enable traps port-security trap-rate 200
To enable SNMP power-over-Ethernet (PoE) traps, use the snmp-server enable traps power-ethernet command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps power-ethernet { group number | police }
no snmp-server enable traps power-ethernet { group number | police }
group number |
Enables inline power group-based traps for the specified group number. Accepted values are from 1 to 9. |
police |
Enables inline power policing traps. |
The sending of power-over-Ethernet SNMP traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to enable power-over-Ethernet traps for group 1:
Switch(config)# snmp-server enable traps poower-over-ethernet group 1
To enable SNMP traps, use the snmp-server enable traps snmp command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps snmp [ authentication ] [ coldstart ] [ linkdown ] [ linkup ] [ warmstart]
no snmp-server enable traps snmp [ authentication ] [ coldstart ] [ linkdown ] [ linkup ] [ warmstart]
authentication |
(Optional) Enables authentication traps. |
coldstart |
(Optional) Enables cold start traps. |
linkdown |
(Optional) Enables linkdown traps. |
linkup |
(Optional) Enables linkup traps. |
warmstart |
(Optional) Enables warmstart traps. |
The sending of SNMP traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to enable a warmstart SNMP trap:
Switch(config)# snmp-server enable traps snmp warmstart
To enable SNMP StackWise traps, use the snmp-server enable traps stackwise command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps stackwise [ GLS] [ ILS] [ SRLS] [ insufficient-power] [ invalid-input-current] [ invalid-output-current] [ member-removed] [ member-upgrade-notification] [ new-master] [ new-member] [ port-change] [ power-budget-warning] [ power-invalid-topology] [ power-link-status-changed] [ power-oper-status-changed] [ power-priority-conflict] [ power-version-mismatch] [ ring-redundant] [ stack-mismatch] [ unbalanced-power-supplies] [ under-budget] [ under-voltage]
no snmp-server enable traps stackwise [ GLS] [ ILS] [ SRLS] [ insufficient-power] [ invalid-input-current] [ invalid-output-current] [ member-removed] [ member-upgrade-notification] [ new-master] [ new-member] [ port-change] [ power-budget-warning] [ power-invalid-topology] [ power-link-status-changed] [ power-oper-status-changed] [ power-priority-conflict] [ power-version-mismatch] [ ring-redundant] [ stack-mismatch] [ unbalanced-power-supplies] [ under-budget] [ under-voltage]
GLS |
(Optional) Enables StackWise stack power GLS trap. |
ILS |
(Optional) Enables StackWise stack power ILS trap. |
SRLS |
(Optional) Enables StackWise stack power SRLS trap. |
insufficient-power |
(Optional) Enables StackWise stack power unbalanced power supplies trap. |
invalid-input-current |
(Optional) Enables StackWise stack power invalid input current trap. |
invalid-output-current |
(Optional) Enables StackWise stack power invalid output current trap. |
member-removed |
(Optional) Enables StackWise stack member removed trap. |
member-upgrade-notification |
(Optional) Enables StackWise member to be reloaded for upgrade trap. |
new-master |
(Optional) Enables StackWise new master trap. |
new-member |
(Optional) Enables StackWise stack new member trap. |
port-change |
(Optional) Enables StackWise stack port change trap. |
power-budget-warning |
(Optional) Enables StackWise stack power budget warning trap. |
power-invalid-topology |
(Optional) Enables StackWise stack power invalid topology trap. |
power-link-status-changed |
(Optional) Enables StackWise stack power link status changed trap. |
power-oper-status-changed |
(Optional) Enables StackWise stack power port oper status changed trap. |
power-priority-conflict |
(Optional) Enables StackWise stack power priority conflict trap. |
power-version-mismatch |
(Optional) Enables StackWise stack power version mismatch discovered trap. |
ring-redundant |
(Optional) Enables StackWise stack ring redundant trap. |
stack-mismatch |
(Optional) Enables StackWise stack mismatch trap. |
unbalanced-power-supplies |
(Optional) Enables StackWise stack power unbalanced power supplies trap. |
under-budget |
(Optional) Enables StackWise stack power under budget trap. |
under-voltage |
(Optional) Enables StackWise stack power under voltage trap. |
The sending of SNMP StackWise traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to generate StackWise stack power GLS traps:
Switch(config)# snmp-server enable traps stackwise GLS
To enable SNMP storm-control trap parameters, use the snmp-server enable traps storm-control command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps storm-control { trap-rate number-of-minutes}
no snmp-server enable traps storm-control { trap-rate}
trap-rate number-of-minutes |
(Optional) Specifies the SNMP storm-control trap rate in minutes. Accepted values are from 0 to 1000. |
The sending of SNMP storm-control trap parameters is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to set the SNMP storm-control trap rate to 10 traps per minute:
Switch(config)# snmp-server enable traps storm-control trap-rate 10
To enable SNMP STPX MIB traps, use the snmp-server enable traps stpx command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps stpx [ inconsistency][ loop-inconsistency][ root-inconsistency]
no snmp-server enable traps stpx [ inconsistency][ loop-inconsistency][ root-inconsistency]
inconsistency |
(Optional) Enables SNMP STPX MIB inconsistency update traps. |
loop-inconsistency |
(Optional) Enables SNMP STPX MIB loop inconsistency update traps. |
root-inconsistency |
(Optional) Enables SNMP STPX MIB root inconsistency update traps. |
The sending of SNMP STPX MIB traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to generate SNMP STPX MIB inconsistency update traps:
Switch(config)# snmp-server enable traps stpx inconsistency
To enable SNMP transceiver traps, use the snmp-server enable traps transceiver command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps transceiver { all}
no snmp-server enable traps transceiver { all}
all |
(Optional) Enables all SNMP transceiver traps. |
The sending of SNMP transceiver traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to set all SNMP transceiver traps:
Switch(config)# snmp-server enable traps transceiver all
To enable SNMP smart install traps, use the snmp-server enable traps vstack command in global configuration mode. Use the no form of this command to return to the default setting.
snmp-server enable traps vstack [ addition][ failure][ lost][ operation]
no snmp-server enable traps vstack [ addition][ failure][ lost][ operation]
addition |
(Optional) Enables client added traps. |
failure |
(Optional) Enables file upload and download failure traps. |
lost |
(Optional) Enables client lost trap. |
operation |
(Optional) Enables operation mode change traps. |
The sending of SNMP smart install traps is disabled.
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
![]() Note |
Informs are not supported in SNMPv1. |
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
This example shows how to generate SNMP Smart Install client-added traps:
Switch(config)# snmp-server enable traps vstack addition
To configure a name for either the local or remote copy of SNMP, use the snmp-server engineID command in global configuration mode.
snmp-server engineID { local engineid-string | remote ip-address [ udp-port port-number] engineid-string}
local engineid-string | Specifies a 24-character ID string with the name of the copy of SNMP. You need not specify the entire 24-character engine ID if it has trailing zeros. Specify only the portion of the engine ID up to the point where only zeros remain in the value. |
remote ip-address | Specifies the remote SNMP copy. Specify the ip-address of the device that contains the remote copy of SNMP. |
udp-port port-number | (Optional) Specifies the User Datagram Protocol (UDP) port on the remote device. The default is 162. |
None
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
None
The following example configures a local engine ID of 123400000000000000000000:
Switch(config)# snmp-server engineID local 1234
To specify the recipient (host) of a Simple Network Management Protocol (SNMP) notification operation, use the snmp-server host global configuration command on the switch. Use the no form of this command to remove the specified host.
snmp-server host { host-addr } [ vrf vrf-instance ] [ informs | traps] [ version { 1 | 2c | 3 { auth | noauth | priv} } ] { community-string [ notification-type] }
no snmp-server host { host-addr } [ vrf vrf-instance ] [ informs | traps] [ version { 1 | 2c | 3 { auth | noauth | priv} } ] { community-string [ notification-type] }
host-addr |
Name or Internet address of the host (the targeted recipient). |
||
vrf vrf-instance |
(Optional) Specifies the virtual private network (VPN) routing instance and name for this host. |
||
informs | traps |
(Optional) Sends SNMP traps or informs to this host. |
||
version 1 | 2c | 3 |
(Optional) Specifies the version of the SNMP used to send the traps. 1—SNMPv1. This option is not available with informs. 2c—SNMPv2C. 3—SNMPv3. One of the authorization keywords (see next table row) must follow the Version 3 keyword. |
||
auth | noauth | priv |
auth (Optional)—Enables Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) packet authentication. noauth (Default)—The noAuthNoPriv security level. This is the default if the auth | noauth | priv keyword choice is not specified. priv (Optional)—Enables Data Encryption Standard (DES) packet encryption (also called privacy). |
||
community-string |
Password-like community string sent with the notification operation. Though you can set this string by using the snmp-server host command, we recommend that you define this string by using the snmp-server community global configuration command before using the snmp-server host command.
|
||
notification-type |
(Optional) Type of notification to be sent to the host. If no type is specified, all notifications are sent. The notification type can be one or more of the these keywords:
|
||
|
This command is disabled by default. No notifications are sent.
If you enter this command with no keywords, the default is to send all trap types to the host. No informs are sent to this host.
If no version keyword is present, the default is Version 1.
If Version 3 is selected and no authentication keyword is entered, the default is the noauth (noAuthNoPriv) security level.
![]() Note |
Though visible in the command-line help strings, the fru-ctrl keyword is not supported. |
Global configuration
Release |
Modification |
---|---|
Cisco IOS XE 3.3SE |
This command was introduced. |
SNMP notifications can be sent as traps or inform requests. Traps are unreliable because the receiver does not send acknowledgments when it receives traps. The sender cannot determine if the traps were received. However, an SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. If the sender never receives the response, the inform request can be sent again, so that informs are more likely to reach their intended destinations.
However, informs consume more resources in the agent and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. Traps are also sent only once, but an inform might be retried several times. The retries increase traffic and contribute to a higher overhead on the network.
If you do not enter an snmp-server host command, no notifications are sent. To configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. If you enter the command with no keywords, all trap types are enabled for the host. To enable multiple hosts, you must enter a separate snmp-server host command for each host. You can specify multiple notification types in the command for each host.
If a local user is not associated with a remote host, the switch does not send informs for the auth (authNoPriv) and the priv (authPriv) authentication levels.
When multiple snmp-server host commands are given for the same host and kind of notification (trap or inform), each succeeding command overwrites the previous command. Only the last snmp-server host command is in effect. For example, if you enter an snmp-server host inform command for a host and then enter another snmp-server host inform command for the same host, the second command replaces the first.
The snmp-server host command is used with the snmp-server enable traps global configuration command. Use the snmp-server enable traps command to specify which SNMP notifications are sent globally. For a host to receive most notifications, at least one snmp-server enable traps command and the snmp-server host command for that host must be enabled. Some notification types cannot be controlled with the snmp-server enable traps command. For example, some notification types are always enabled. Other notification types are enabled by a different command.
The no snmp-server host command with no keywords disables traps, but not informs, to the host. To disable informs, use the no snmp-server host informs command.
This example shows how to configure a unique SNMP community string named comaccess for traps and prevent SNMP polling access with this string through access-list 10:
Switch(config)# snmp-server community comaccess ro 10 Switch(config)# snmp-server host 172.20.2.160 comaccess Switch(config)# access-list 10 deny any
This example shows how to send the SNMP traps to the host specified by the name myhost.cisco.com. The community string is defined as comaccess:
Switch(config)# snmp-server enable traps Switch(config)# snmp-server host myhost.cisco.com comaccess snmp
This example shows how to enable the switch to send all traps to the host myhost.cisco.com by using the community string public:
Switch(config)# snmp-server enable traps Switch(config)# snmp-server host myhost.cisco.com public
You can verify your settings by entering the show running-config privileged EXEC command.
Command |
Description |
snmp-server enable traps |
Enables the switch to send SNMP notifications for various traps or inform requests to the NMS. |