RSPAN problem

Unanswered Question
Jul 30th, 2009
User Badges:

I have two switches. One core switch and another access switch which both I am trying to monitor the traffic using the following statements.


Core sw __Gi1/0/5_ Access switch

|_________Gi1/0/3_ Monitoring console

|_________Gi1/0/1_ PC


! On the core switch

monitor session 1 source remote vlan 999

monitor session 1 destination interface Gi1/0/3

monitor session 2 source interface Gi1/0/1 rx

monitor session 2 destination remote vlan 999


I can monitor the access switch, the problem is that Gi1/0/1 which is local to the core switch gives me nothing when I monitor it.


! This 2 statements doesn't seem to work for me.

monitor session 2 source interface Gi1/0/1 rx

monitor session 2 destination remote vlan 999


Any help would be appreciated.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Giuseppe Larosa Fri, 07/31/2009 - 00:46
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Mun,

it is unclear what you are trying to do.


vlan 999 is a remote span vlan and allows you to capture traffic on access layer switch to carry it inside vlan 999 over a trunk port to core switch and to deliver it on port g1/0/3.


then you have a second session with source g1/0/1.


if you want to have on g1/0/3 traffic from both vlan999 and port g1/0/1 you should try:

use a single monitor session with two sources and one destination


In other words if you put traffic on vlan999 you are sending it to access layer switch not to port g1/0/3.


I understand you think access switch could reflect it to core switch but this is not happening I guess.


Hope to help

Giuseppe


alanchia2000 Fri, 07/31/2009 - 03:01
User Badges:

Hi Giuseppe,



Thanks for explaining the concept for the 2nd session.


What you mentioned is what my intentions are. The problem is I am using Cisco 3750 and "use a single monitor session with two sources and one destination" is not allowing me to do that. I can have only 1 of the source running on switch.



Regards,

Alan

Actions

This Discussion