RSPAN not working

kjackson74 · ‎06-07-2007

I have read through other conversations, I think I am configuring everything exactly like I should, but I still don't see traffic from the source pc in my trace file. I have a 2950 with version 12.1(13)EA1b--that has the source port configured and a reflector-port, which is not hooked up to anything. Then I have a 3560 with version 12.2(24)SEB4 that has a port set up as the destination port. I know my RSPAN VLAN works because I tried it out before, but not on a switch that requires a reflector port. When I read about reflector ports, it said that it had to have its loopback set. What does that mean? My destination port appears to be working because I can't ping out or anything on it. And the reflector-port on the 2950 is blinking, so I am thinking it is at least attempting to work. Any ideas on what I am doing wrong?

Thanks

markfester · ‎06-07-2007

One of the things I overlooked while configuring RSPAN was that the destination switch needs to have the remote vlan as a source. Then, the destination would be configured as your sniffer port.

kjackson74 · ‎06-07-2007

Thanks, I do have it as my source. The weird thing is, I get a bunch of broadcast/multicast traffic, just not unicast from my pc. I tried setting it up as both, then as tx, but nothing works. Very annoying :)

bryan.lofland · ‎06-21-2007

kjackson,

I am experiencing the same thing. I have a Cisco 4948 that shows VLAN 200 is for RSPAN. I have this configured on it:

monitor session 1 source int g1/9

monitor session 1 destination remote vlan 200

I have allowed VLAN 200 to pass on my trunks. On my Cisco 4506 I have the following configured:

monitor session 2 source remote vlan 200

monitor session 2 destination int g3/30

I get no data as well, I just get the typical VTP and occassional EIGRP broadcast traffic.

Any ideas?

Thanks,

Bryan

bryan.lofland · ‎06-21-2007

Well that was quick,

I didn't have the destination port on my 4506 set to access vlan 200! It is fixed now.

One other note that someone might find interesting is that you can't use RSPAN if you are trying to monitor a port on the same switch that the sniffer is attached to. You must use SPAN instead. I imagine it is because RSPAN floods the trunks with the RSPAN VLAN traffic and RSPAN can't bypass the trunks to give a local port the mirror but any better/correct explanation is more than welcome!

Bryan

kjackson74 · ‎06-25-2007

Bryan,

Glad you got it working. I redid the config on mine, I let it capture for about 20 minutes and I saw the unicast traffic. Don't know what I did wrong the first time. But I think RSPAN is very cool. Now I just need to learn how to read the trace files :)