SPAN sessions

Unanswered Question

I'm running into a problem with the span session limits on the 6500's...right now we have two 6500's connected to each other with Layer 2 ether channel trunks, and both use monitor session 1 for the IDS. I use monitor session 2 for general trouble shooting when I need to...however now I have the need to add a 3rd and 4th session (for a net management tool and a filter) can I go about doing this with a 2 session limit?

Should I think about adding another switch (a 3750 or something like that) and just have a few RSPAN sessions on the 6500's sending traffic over to the 3750, and set up all the management tools as well as the IDS on there?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Kerem Gursu Wed, 02/18/2009 - 07:39

In a similar situation , I have replicated the span session with a network tap device. You only use one span session , but the tap device replicates this session within its ports.

There are many suppliers for this device , you can choose one of them.

Hope to help,


taali Wed, 02/18/2009 - 07:45

Virtual SPAN may be able to help here.

You can set up a single source SPAN with multiple destination trunk ports. As of 12.2(18)SXD, you can filter each destination trunk port by vlan. See the attached pdf for more information.



This Discussion