Hi, I have couple of questions.
1) Can we add multiple sniffing links or configure multiple capture eth on single AMD?
2) Can we make one Ethernet works as capture+Communication link, in case of ER SPAN. For example if we have an AMD box having two nic cards one for communication and other for Capture (sniffing) and local spanning is enabled on one of the capture link. can I use other communication link available on the AMD to use as capture link for ER SPAN as well. (Capt+Comm) is possible to configure for single NIC?. ER SPAN is encapsulated Remote Span.
Solved! Go to Solution.
You can set all connected unused ports to capture mode:
Ensure that the link is detected for all of the relevant ports. Connect a network cable to the interface and observe the interface being recognized by
rtminst. The interface will appear as
Y in the Link det. column.
You are prompted to confirm your choice, after confirming, the ports listed as capture ports appear in the table. Select
[A] to set all connected unused ports to capture mode.
Although it is possible to designate all of the NICs as communication ports, this configuration is not functional because no capture ports would be available on the device.
Have a look on the following link for more informaiton.
Regarding the ER SPAN question, no it is not possible to have the comm interface also be the termination point of the ER SPAN. You will need to have the switch the AMD's sniffing interfaces connect to be the termination point of the ER SPAN, and then that switch provides the traffic from the ER SPAN to the AMD on one of the sniffing interfaces.