IPv6 traffic seem in RSPAN

jayshihlin · ‎09-16-2009

Hi All,

I am having a strange issue on Remote SPAN. I have Remote SPAN setup across multiple switches and also configured rspan vlan be part of trunk between the switches.

Here is source switch (switch_A):

monitor session 66 source interface Gi1/0/1

monitor session 66 destination remote vlan 999

Here is destination switch (Catalyst 3560 switch_B):

monitor session 66 destination interface Fa0/1

monitor session 66 source remote vlan 999

On the switch_B, the uplink also carries other user vlans. It seems like when I plug-in my wireshark into switch_B fa0/1, the wireshark also pickup IPv6 traffic (MDNS, DHCPv6 Solicit, UDP IPv6 Multicast) from other vlan that is part of switch_B trunk and those IPv6 is not in source switch at all.

I have checked all my switches and only switch_A had source RSPAN at this time. Just wondering is MDNS, DHCPv6 Solicit, IPv6 Multicast can across vlans? Any suggestions are appreciated.

Thanks,

JL

Giuseppe Larosa · ‎09-16-2009

Hello Jay,

>> Just wondering is MDNS, DHCPv6 Solicit, IPv6 Multicast can across vlans?

this cannot happen however check intermediate switches with

sh vlan 999

try to see if there are user ports in vlan999.

remote span vlan disables mac address learning to be able to mirror traffic so any port part of vlan999 on the path will see its traffic replicated to the destination port.

Hope to help

Giuseppe

jayshihlin · ‎09-24-2009

Open the TAC case with Cisco and they found out this is a bug CSCsr64007.

Thanks!

Giuseppe Larosa · ‎09-24-2009

Hello Jay,

thanks for providing feedback on this issue.

this appears a strange bug but it exists.

Hope to help

Giuseppe