[c-nsp] Identifying SPAN ports via SNMP?

[lee.e.rian at census.gov]

"null yathrib" <yathrib.public at gmail.com> wrote on 11/04/2006 01:00:40 PM:
> On 11/2/06, Dale W. Carder <dwcarder at doit.wisc.edu> wrote:
> > See if you can still get that information out of CISCO-STACK-MIB.
> >
> > http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?
> > local=en&translate=Translate&objectInput=monitorGroup
>
> No, that mib is deprecated.

Maybe so, but you can still get the information you're looking for out of
CISCO-STACK-MIB.my:

-- the monitor group

-- Implementation of the monitor group is current for all Cisco
-- Workgroup Stack products which implement port monitoring functions.
--
-- The monitorGrp is deprecated and replaced by
-- portCopyTable defined in SMON-MIB.


Here's the info returned by one of our Sup720s configured with
  monitor session 1 source interface Gi5/1 tx
  monitor session 1 destination interface Fa9/48

% snmpwalk sup720 portCopyTable
SMON-MIB::portCopyDestDropEvents.29.104 = Counter32: 0 events
SMON-MIB::portCopyDirection.29.104 = INTEGER: copyTxOnly(2)
SMON-MIB::portCopyStatus.29.104 = INTEGER: notReady(3)
% snmpwalk sup720 ifName.29
IF-MIB::ifName.29 = STRING: Gi5/1
% snmpwalk sup720 ifName.104
IF-MIB::ifName.104 = STRING: Fa9/48
%

hrmmm... INTEGER: notReady(3) I'm guessing the sniffer has been "borrowed"
sup720>sh int f9/48
FastEthernet9/48 is down, line protocol is down (monitoring)

Regards,
Lee