Strange RSPAN behavior

Unanswered Question
Mar 13th, 2007
User Badges:

Hi,


I try to set a RSPAN session but I didn't get what I expected.


My configuration:


First I set up a RSPAN VLAN (id 999) on the vtp server switch.


vlan 999

remote-span


----------------------------------


Source ports set up on a 3550 (12.1(22)EA8a)


monitor session 1 source interface Fa0/48

monitor session 1 destination remote vlan 999 reflector-port Fa0/30


-------------------------------


Destination port on a C2940 (12.1(22)EA8a)


monitor session 1 source remote vlan 999

monitor session 1 destination interface Fa0/3


-------------------------


If I plug in a sniffer on port 3 of the 2940 I see broadcast, multicast and some unicast traffic. The strange thing about the unicast traffic is that it doesn't belongs to the PC which is connected to the source port.


Also if I PING the PC on the source port I didn't see the ICMP packets on the sniffer.


Any ideas?


Best regards,

Christoph

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
Richard Burts Tue, 03/13/2007 - 06:43
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Christoph


Is there a trunk between the switches that is carrying vlan 999?


HTH


Rick

MicronasSS Tue, 03/13/2007 - 06:45
User Badges:

Rick,


Yes, there is a trunk between the switches and all VLANs are allowed on the trunk.



Amit Singh Tue, 03/13/2007 - 07:03
User Badges:
  • Cisco Employee,

Christoph,


Have you configured " remote-span" under the vlan 999 on 2940 switch. Please verify is with the output of " show vlan "


-amit singh

MicronasSS Tue, 03/13/2007 - 07:11
User Badges:

Amit,


both switches are member of the same vtp domain. Iconfigured VLAN 999 on the vtp server along with "remote-span".


"show vlan" on both switches says that VLAN 999 is a Remote SPAN VLAN.


Amit Singh Tue, 03/13/2007 - 07:40
User Badges:
  • Cisco Employee,

Christoph,


2940 switches do not support RSPAN, though the IOS lets you configure the commands on it. It only supports SPAN on the box.


http://www.cisco.com/en/US/partner/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#Cat500


http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2940/12119ea1/2940scg/swspan.htm


HTH,Please rate if it does.

-amit singh

MicronasSS Tue, 03/13/2007 - 08:32
User Badges:

Amit,


I replaced the 2940 with a 2950 and it works :).


Thanks for that info.


Best regards,

Christoph

MicronasSS Tue, 03/13/2007 - 08:35
User Badges:

Amit,


I have one other question.

Do you know if the new Cisco 3540 will support this feature?


Thanks again.



Amit Singh Tue, 03/13/2007 - 08:39
User Badges:
  • Cisco Employee,

3540 ????


I think you are talking about 3560 switch. Yes, this switch supports RSPAN and you will be able to configure and use it.


HTH,


-amit singh

MicronasSS Tue, 03/13/2007 - 08:40
User Badges:

Oops,


not 3540.

I mean 2960 (8 Port) or 3560 (8 Port).

Amit Singh Tue, 03/13/2007 - 08:59
User Badges:
  • Cisco Employee,

Yes, both of them supports RSPAN.


-amit singh

ogor Thu, 06/07/2007 - 01:09
User Badges:

Hi Christoph,


I have performed the same RSPAN like you but not working even on a 2950 and 4506.


Please can you give me some informations about the status of the show int vlan 999 on the 3550 ?

in which vlan have you put the sniffer port ? => vlan 999 ?!!


thanks in advance

Olivier

Actions

This Discussion