monitor session issue...

william.briere · ‎04-15-2008

Hello,

I have 8 Cisco 3560 switches running rapid spanning tree on a single vlan where VOIP is the traffic. I have a call recording server plugged into one of the ports looking to listen into the traffic on that vlan.

I put the following statement on one of the switches. The problem is the call recorder does not seem to see all the calls?? I am trying to rule out the switches in this case. Can you see anything I'm missing?

monitor session 1 source vlan XX

monitor session 1 destination interface fa0/Y

The switches are all connected via the SFP ports and this is all layer 2.

Thanks in advance

jcoke · ‎04-15-2008

You need to be using RSPAN otherwise calls between switches that don't host the call recording server will not be picked up.

Configuring SPAN and RSPAN

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_44_se/configuration/guide/swspan.html

william.briere · ‎04-15-2008

Hello,

Thanks for the reply...

So ultimately that has me adding within my layer 2 vlan the "remote-span" command. Then it has me specifying the following... Is this right?

monitor session 2 source remote vlan XX

monitor session 2 destination interface fa0/XY

Is that what your saying? I guess I'm puzzled by the need for RSPAN as I would assume when I type what you see below that it would send all traffic from all 8 switches to this destination assuming they are all part of the same Vlan???

monitor session 1 source vlan XX

monitor session 1 destination interface fa0?XY

jcoke · ‎04-15-2008

OK. So, call record server is on switch A and there are 2 phones (call them 1 and 2) on switch B. Server and the phones are in vlan 2 and the switches are trunked (1q or isl). If the phones call each other, that traffic is not going to be placed on the trunk back to switch A. Therefore the monitoring config on switch A never picks anything up. Now, if a phone - call it 3 - on switch A calls phones 1 or 2 then the traffic will be "seen" by your configuration and echoed into the span destination.

The limitation of SPAN is that the interesting traffic must traverse the switch where SPAN is configured. RSPAN removes that limitation.