Mmm, I think this is a bit different. In the case of the 4500 there is no need for a reflector port. Maybe there is a hidden one implemented in the ASIC.

But my question was more about the behavior when monitoring a VLAN:

monitor session 1 source vlan 2

monitor session 1 destination remote vlan 40

In this case, I seem to see every packet on the VLAN 2 twice. I know they are the same packets because the UDP ids are the same. However, the DSCP markings are different with re-marking the packet, which is what makes me suspect that it monitors once on ingress and once again on egress (on vlan 2).

Can anyone confirm these observations?

Kevin Dorrell

Luxembourg

Kevin,

From the explanation below my interpretation of what you are seeing is the rx traffic of vlan 2 and tx traffic of destination port. Another reason why I think this may be the case is due to the fact you can only monitor rx traffic when your monitor source is a VLAN itself.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/5.x/configuration/guide/span.html

In some SPAN configurations, multiple copies of the same source packet are sent to the SPAN destination port. For example, a bidirectional (both ingress and egress) SPAN session is configured for sources a1 and a2 to a destination port d1. If a packet enters the switch through a1 and gets switched to a2, both incoming and outgoing packets are sent to destination port d1; both packets would be the same (if a Layer-3 rewrite occurrs, the packets are different). Similarly, for RSPAN sessions with sources distributed in multiple switches, the destination ports might forward multiple copies of the same packet.

HTH

Sundar

Hello Kevin,

Have you tried the option rx /tx to capture one way traffic ?

monitor session 1 source vlan 2 [rx/tx]

by default, traffic in both directions are captured of a source vlan/interface.

HTH

Padmanabhan

Kevin,

Thinking a little further I guess this behavior may be due to the fact your monitor source is VLAN, which can span multiple switches.

Can you try setting a port, instead of VLAN 2, as the source with the same RSPAN setup that you have now and check whether you see the same behavior.

HTH

Sundar

Sundar,

Yes, you are right. It seems that if you source from a VLAN, and a packet eneters by that VLAN and leaves by the same VLAN, then the monitor will see it twice: once as it enters the switch and once as it leaves.

Of course, if it leaves by a different VLAN because it has been routed, then you will only see it once.

That is useful, because you can see the "before and after" effects of re-marking the packet. But it did take me by surprise when I thought I was seeing double.

If you want to see each packet only once, then you have to specify rx (to see the packets as they ingress) or tx (to see packets as they egress).

Kevin Dorrell

Luxembourg

That's a good idea. I tried with just rx and with just tx, and I got only one copy of each packet.

It is interesting, because in the case of a VLAN source the rx and the tx are not really about traffic direction. They are about coming into the switch and leaving the switch.

If you specify rx, then you get to see the packets as they ingress the switch. Packets for a particular flow are entering by port A and leaving by port B. In the other direction, they are entering by port B and leaving by port A. The SPAN gets to see the ingress traffic, i.e. the traffic as it enters port A for one direction, and the traffic as it enters port B for the other direction.

If you specify tx, then you get to see the packets as they egress the switch. Packets for a particular flow are entering by port A and leaving by port B. In the other direction, they are entering by port B and leaving by port A. The SPAN gets to see the egress traffic, i.e. the traffic as it leaves port B for one direction, and the traffic as it leaves port B for the other direction.

If you don't specify rx or tx, then you get to see both. Each packet is monitored twice: once as it enters the switch at port A, and once as it leaves it at port B. And vice versa for the other direction.

Kevin Dorrell

Luxembourg