SPAN

Unanswered Question

Here is my understanding:


RSPN: Remote switch port analyzer. If you want to capture/sniff the traffic passing through a switchport you can take help of SPAN, but your port to be captured and port where your sniffer is should lie on the same switch.


using RSPAN you can sniff the traffic of a remote switchport i.e. port which is not in local switch, your sniffer and port to be monitored will be on different switches.


you have to assign below configs:


At Source side:

source local and destination remote, Ex.

1#monitor session 2 source int fast0/12

1#monitor session 2 destination remote vlan100


At destination/Sniffer side:

source remote and destination local, Ex.

2#monitor session 4 source remote vlan100

2#monitor session 4 destination int fast0/24


I'm assuming that the sniffer is connected to fast0/24.


Please let us know if I'm able to remove some your confusions.

Hi,


What model is the switch you are configuring the RSPAN on? If it is not 2950/2955 you can leave the idea of configuring reflector port. But if they are 2950/2955 switches, you can assign any free port (no device connected to that port) as reflector port. Assign this port to be RSPAN vlan.


Abt RX/TX, I would say it depends on your requirements. Normally config 'both' instead of RX/TX if you want both received and transmitted bits to be sniffed.


kindly let me know if you have some more querries. Have a look at the link below:

http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_11_yj4/configuration/guide/swspan.html


--gaurav

Actions

This Discussion