05-10-2007 07:04 AM - last edited on 03-25-2019 03:54 PM by ciscomoderator
Hi
I have just set a RSPAN vlan and some ports to monitor but dont seem to be receiving any IP traffic. I can see the MAC addresses of hosts im trying to monitor across the RSPAN vlan.
Any ideas ?
Cheers
switch with sniffer connected
Session 1
---------
Type : Remote Destination Session
Source RSPAN VLAN: 900
Destination Ports : Fa0/32
Encapsulation : Native
Ingress: Disabled
switch with hosts trying to monitor
Rspan Type : Source
Destination : -
Reflector : Port 2/48
Rspan Vlan : 900
Admin Source : Port 2/2
Oper Source : Port 2/2
Direction : transmit/receive
Incoming Packets: -
Learning : -
Filter : -
Status : active
05-10-2007 07:45 AM
Can you post
show run | i monitor
from each switch ?
05-10-2007 07:47 AM
Stephen
Is there a trunk configured between the switches that is configured to carry VLAN 900? There needs to be a trunk between the switches for the RSPAN VLAN.
HTH
Rick
05-10-2007 10:34 PM
Hi Rick
VLAN900 is allowed accross the trunk, I can see the MAC address of the host im trying to capture.
config as below
Host monitor switch
#switch port analyzer
set rspan source 2/2 900 both reflector 2/48 create
Switch with Sniffer connected
monitor session 1 destination interface Fa0/32
monitor session 1 source remote vlan 900
05-11-2007 07:18 AM
Stephen
Thanks for the additional information. Perhaps you can also post the configuration of the trunk on both switches. It might also be helpful if you would post the output of show trunk on both switches.
HTH
Rick
05-13-2007 10:38 PM
Hi
Outputs for show trunk
Switch with sniffer connected
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Gi0/2 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi0/1 1-4094
Gi0/2 1-4094
Port Vlans allowed and active in management domain
Gi0/1 1,10-11,40,50,900,999
Gi0/2 1,10-11,40,50,900,999
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1,10-11,40,50,900,999
Gi0/2 1,10-11,40,50,900,999
switch with hosts
Port Mode Encapsulation Status Native vlan
-------- ----------- ------------- ------------ -----------
2/49 on dot1q trunking 1
Port Vlans allowed on trunk
-------- ---------------------------------------------------------------------
2/49 1-1005,1025-4094
Port Vlans allowed and active in management domain
-------- ---------------------------------------------------------------------
2/49 1,10-12,15-16,20,50,60,90,102,230,900
Port Vlans in spanning tree forwarding state and not pruned
-------- ---------------------------------------------------------------------
2/49 1,10-12,15-16,20,50,60,90,102,230,900
05-11-2007 02:58 PM
Do you have the VLAN 900 defined as "remote-span" ?
IE:
switch(config)# vlan 900
switch(config-vlan)# remote-span
Also, RSPAN on 2950 supports either Tx or Rx, but not Tx/Rx together for some reason.
P.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: