Remote Span

Unanswered Question
Jul 18th, 2008
User Badges:

I have 2 6509's with the following (IOS (tm) s72033_rp Software (s72033_rp-IPSERVICESK9-VM), Version 12.2(18)SXF10,


I am trying to do a Remote Spanning port , meaning connect a sniffer to a port on core1 (with a monitor session configured) and be able to monitor a port on the other core switch. How can this be achieved?

I figured if a vlan is monitored, it should not make a difference where you connect the sniffer to as it is a logical broadcast domain, is that correct?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (1 ratings)
Giuseppe Larosa Fri, 07/18/2008 - 11:52
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Roni,

RSPAN requires a dedicated Remote Span VLAN that is used for this job.

The Remote span vlan should be defined at layer 2 only on a dedicated link between the two switches (because mac address learning is disabled on it and for bandwidth space)

This Vlan is used as the destination on the switch where there is the source port.

Depending on platform and release a reflector port can be needed (not needed in c6509 if I remember correctly)

Hope to help


ronshuster Mon, 07/21/2008 - 04:53
User Badges:

How would the RSPAN config look like, meaning:

If I was to monitor a port on CoreSwitch1 (CS1) using a sniffer on CS2, I need to create a layer 2 vlan on CS1 (which will be learned on CS2 due to VTP advertisements), how would that traffic make it to the monitoring port on the other switch? what would the config look like?


This Discussion