cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
726
Views
5
Helpful
8
Replies

Need explanation on SPAN and RSPAN limitations

pipsadmin
Level 1
Level 1

C6513 w/SUP720-3B

This is what I have in my SW1.

I have 4 6500 series switches... I need to mirror several port and bring them to 1 device on 2 x 1Gb ports.

I use RSPAN VLAN 1051 for SW1, RSPAN 1052 for SW2, RSPAN 1053 for SW3 and RSPAN 1054 for SW4.

SW3-4 are at another location that is linked via a 10Gb link.

Here is my "show monitor" on my sw1 where my diagnostic system is located.

Session 1

---------

Type : Remote Source Session

Source Ports :

Both : Gi2/3,Gi2/37

Destination RSPAN VLAN : 1051

Session 2

---------

Type : Remote Source Session

Source Ports :

Both : Gi2/38,Gi10/3,Gi12/44,Gi12/48

Destination RSPAN VLAN : 1052

Session 3

---------

Type : Remote Destination Session

Source RSPAN VLAN : 1051

Destination Ports : Gi4/21

Session 4

---------

Type : Remote Destination Session

Source RSPAN VLAN : 1052

Destination Ports : Gi12/45

PIPSCORESW1(config)#monitor session 5 source int g12/48

% Local Session limit has been exceeded

PIPSCORESW1(config)#

I cannot seem to monitor anymore ports... Why is that?

8 Replies 8

Lucien Avramov
Level 10
Level 10

Depending on what hardware you have, there are limitations on the number of ports, check this document:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html#wp1037601

Ok, so I should be within the amount of span and rspan, so why can't i do this?

As per the document you can have 2 source rspan sessions max.

You already have two source rspan session and therefore can not add a third one. (session 1 and 2 in your show output)

ok, then my other question is this.

If you have 2 6500's connected together via trunks sharing all vlans between each other, if the monitor session is set for source vlan 100 and destination int g12/43 on SW1 for example, if traffic comes into vlan 100 on SW2, will it be sent to the SW1 monitor session? Or do you need to setup an RSPAN on SW2 to send VLAN 100 traffic on it, to SW1 ?

In my case I have VLANS that span 4 switches, but I need the monitor session to be on 1 switch but make sure it captures ALL vlan traffic no matter what switch it comes in or out of.

Anyone?

anyone know the answer to this?

sw1---trunk---sw2

the vlan 100 traffic on sw1, will be spanned if it hits sw1 and not sw2.

If you want to monitor spanned traffic on sw2, you need a span session there.

remote span is when your destination is not on sw1, but you want to monitor the traffic on sw1.

HTH

Is there any way to have more SPAN/RSPAN sessions available?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: