6500 SPAN and QoS Markings

Answered Question
Jul 23rd, 2010

If I monitor a port with SPAN on a 6500 and the device is sending in traffic marked with DSCP values but the port is not configured to trust dscp or cos (mls qos is on globally) will I see the packets before they are rewritten with the dscp value the device is sending in or after they have been rewritten with a dscp value of 0?

Thanks in advance

I have this problem too.
0 votes
Correct Answer by krahmani323 about 6 years 4 months ago

You are welcome Nick.

The information comes from "CCIE R&S 4th Edition - Chapter 1" (http://www.ciscopress.com/bookstore/product.asp?isbn=1587059800)

We can also find the information at this non-cisco link : http://www.proprofs.com/flashcards/tableview.php?title=span-rspan

But I suppose the same information is given diffently on this Cisco link :

http://www.ciscosystems.md/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html#wp1059824

For example : A SPAN destination port that is copying traffic  from a single egress SPAN source port sends only egress traffic to the  network analyzer

(meaning after treatment of the packet).

Hope it helps.

Karim

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
krahmani323 Fri, 07/23/2010 - 01:40

Hello n.oneill,

From the documentation :

SPAN and RSPAN support two types of traffic: transmitted and received. By default, SPAN is
enabled for traffic both entering and exiting the source port or VLAN. However, SPAN can be
configured to monitor just transmitted traffic or just received traffic. Some additional conditions
apply to these traffic types, as detailed in this list:

For Receive (RX) SPAN, the goal is to deliver all traffic received to the SPAN destination. As
a result, each frame to be transported across a SPAN connection is copied and sent before any
modification
(for example, VACL or ACL filtering, QoS modification, or even ingress or
egress policing).

For Transmit (TX) SPAN, all relevant filtering or modification by ACLs, VACLs, QoS, or
policing actions are taken before the switch forwards the traffic to the SPAN/RSPAN
destination
. As a result, not all transmit traffic necessarily makes it to a SPAN destination.
Also, the frames that are delivered do not necessarily match the original frames exactly,
depending on policies applied before they are forwarded to the SPAN destination.

Thanks

Karim

n.oneill Fri, 07/23/2010 - 02:13

Thanks Karim

Could you please link the documentation you are refrerring to?

Regards

Nick

Correct Answer
krahmani323 Fri, 07/23/2010 - 02:38

You are welcome Nick.

The information comes from "CCIE R&S 4th Edition - Chapter 1" (http://www.ciscopress.com/bookstore/product.asp?isbn=1587059800)

We can also find the information at this non-cisco link : http://www.proprofs.com/flashcards/tableview.php?title=span-rspan

But I suppose the same information is given diffently on this Cisco link :

http://www.ciscosystems.md/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html#wp1059824

For example : A SPAN destination port that is copying traffic  from a single egress SPAN source port sends only egress traffic to the  network analyzer

(meaning after treatment of the packet).

Hope it helps.

Karim

Actions

This Discussion