cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
551
Views
0
Helpful
6
Replies

RSPAN woes

stephen.baugh
Level 1
Level 1

Hi

I have just set a RSPAN vlan and some ports to monitor but dont seem to be receiving any IP traffic. I can see the MAC addresses of hosts im trying to monitor across the RSPAN vlan.

Any ideas ?

Cheers

switch with sniffer connected

Session 1

---------

Type : Remote Destination Session

Source RSPAN VLAN: 900

Destination Ports : Fa0/32

Encapsulation : Native

Ingress: Disabled

switch with hosts trying to monitor

Rspan Type : Source

Destination : -

Reflector : Port 2/48

Rspan Vlan : 900

Admin Source : Port 2/2

Oper Source : Port 2/2

Direction : transmit/receive

Incoming Packets: -

Learning : -

Filter : -

Status : active

6 Replies 6

Edison Ortiz
Hall of Fame
Hall of Fame

Can you post

show run | i monitor

from each switch ?

Stephen

Is there a trunk configured between the switches that is configured to carry VLAN 900? There needs to be a trunk between the switches for the RSPAN VLAN.

HTH

Rick

HTH

Rick

Hi Rick

VLAN900 is allowed accross the trunk, I can see the MAC address of the host im trying to capture.

config as below

Host monitor switch

#switch port analyzer

set rspan source 2/2 900 both reflector 2/48 create

Switch with Sniffer connected

monitor session 1 destination interface Fa0/32

monitor session 1 source remote vlan 900

Stephen

Thanks for the additional information. Perhaps you can also post the configuration of the trunk on both switches. It might also be helpful if you would post the output of show trunk on both switches.

HTH

Rick

HTH

Rick

Hi

Outputs for show trunk

Switch with sniffer connected

Port Mode Encapsulation Status Native vlan

Gi0/1 on 802.1q trunking 1

Gi0/2 on 802.1q trunking 1

Port Vlans allowed on trunk

Gi0/1 1-4094

Gi0/2 1-4094

Port Vlans allowed and active in management domain

Gi0/1 1,10-11,40,50,900,999

Gi0/2 1,10-11,40,50,900,999

Port Vlans in spanning tree forwarding state and not pruned

Gi0/1 1,10-11,40,50,900,999

Gi0/2 1,10-11,40,50,900,999

switch with hosts

Port Mode Encapsulation Status Native vlan

-------- ----------- ------------- ------------ -----------

2/49 on dot1q trunking 1

Port Vlans allowed on trunk

-------- ---------------------------------------------------------------------

2/49 1-1005,1025-4094

Port Vlans allowed and active in management domain

-------- ---------------------------------------------------------------------

2/49 1,10-12,15-16,20,50,60,90,102,230,900

Port Vlans in spanning tree forwarding state and not pruned

-------- ---------------------------------------------------------------------

2/49 1,10-12,15-16,20,50,60,90,102,230,900

mpc
Level 1
Level 1

Do you have the VLAN 900 defined as "remote-span" ?

IE:

switch(config)# vlan 900

switch(config-vlan)# remote-span

Also, RSPAN on 2950 supports either Tx or Rx, but not Tx/Rx together for some reason.

P.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: