10-06-2009 09:15 AM
C6513 w/SUP720-3B
This is what I have in my SW1.
I have 4 6500 series switches... I need to mirror several port and bring them to 1 device on 2 x 1Gb ports.
I use RSPAN VLAN 1051 for SW1, RSPAN 1052 for SW2, RSPAN 1053 for SW3 and RSPAN 1054 for SW4.
SW3-4 are at another location that is linked via a 10Gb link.
Here is my "show monitor" on my sw1 where my diagnostic system is located.
Session 1
---------
Type : Remote Source Session
Source Ports :
Both : Gi2/3,Gi2/37
Destination RSPAN VLAN : 1051
Session 2
---------
Type : Remote Source Session
Source Ports :
Both : Gi2/38,Gi10/3,Gi12/44,Gi12/48
Destination RSPAN VLAN : 1052
Session 3
---------
Type : Remote Destination Session
Source RSPAN VLAN : 1051
Destination Ports : Gi4/21
Session 4
---------
Type : Remote Destination Session
Source RSPAN VLAN : 1052
Destination Ports : Gi12/45
PIPSCORESW1(config)#monitor session 5 source int g12/48
% Local Session limit has been exceeded
PIPSCORESW1(config)#
I cannot seem to monitor anymore ports... Why is that?
10-06-2009 09:20 AM
Depending on what hardware you have, there are limitations on the number of ports, check this document:
10-06-2009 09:34 AM
Ok, so I should be within the amount of span and rspan, so why can't i do this?
10-06-2009 09:47 AM
As per the document you can have 2 source rspan sessions max.
You already have two source rspan session and therefore can not add a third one. (session 1 and 2 in your show output)
10-07-2009 03:49 AM
ok, then my other question is this.
If you have 2 6500's connected together via trunks sharing all vlans between each other, if the monitor session is set for source vlan 100 and destination int g12/43 on SW1 for example, if traffic comes into vlan 100 on SW2, will it be sent to the SW1 monitor session? Or do you need to setup an RSPAN on SW2 to send VLAN 100 traffic on it, to SW1 ?
In my case I have VLANS that span 4 switches, but I need the monitor session to be on 1 switch but make sure it captures ALL vlan traffic no matter what switch it comes in or out of.
10-07-2009 07:59 AM
Anyone?
10-08-2009 05:26 AM
anyone know the answer to this?
10-10-2009 12:26 PM
sw1---trunk---sw2
the vlan 100 traffic on sw1, will be spanned if it hits sw1 and not sw2.
If you want to monitor spanned traffic on sw2, you need a span session there.
remote span is when your destination is not on sw1, but you want to monitor the traffic on sw1.
HTH
10-13-2009 04:42 AM
Is there any way to have more SPAN/RSPAN sessions available?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: