cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1525
Views
5
Helpful
5
Replies

6500 SPAN and QoS Markings

n.oneill
Level 1
Level 1

If I monitor a port with SPAN on a 6500 and the device is sending in traffic marked with DSCP values but the port is not configured to trust dscp or cos (mls qos is on globally) will I see the packets before they are rewritten with the dscp value the device is sending in or after they have been rewritten with a dscp value of 0?

Thanks in advance

1 Accepted Solution

Accepted Solutions

You are welcome Nick.

The information comes from "CCIE R&S 4th Edition - Chapter 1" (http://www.ciscopress.com/bookstore/product.asp?isbn=1587059800)

We can also find the information at this non-cisco link : http://www.proprofs.com/flashcards/tableview.php?title=span-rspan

But I suppose the same information is given diffently on this Cisco link :

http://www.ciscosystems.md/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html#wp1059824

For example : A SPAN destination port that is copying traffic  from a single egress SPAN source port sends only egress traffic to the  network analyzer

(meaning after treatment of the packet).

Hope it helps.

Karim

View solution in original post

5 Replies 5

krahmani323
Level 3
Level 3

Hello n.oneill,

From the documentation :

SPAN and RSPAN support two types of traffic: transmitted and received. By default, SPAN is
enabled for traffic both entering and exiting the source port or VLAN. However, SPAN can be
configured to monitor just transmitted traffic or just received traffic. Some additional conditions
apply to these traffic types, as detailed in this list:

For Receive (RX) SPAN, the goal is to deliver all traffic received to the SPAN destination. As
a result, each frame to be transported across a SPAN connection is copied and sent before any
modification
(for example, VACL or ACL filtering, QoS modification, or even ingress or
egress policing).

For Transmit (TX) SPAN, all relevant filtering or modification by ACLs, VACLs, QoS, or
policing actions are taken before the switch forwards the traffic to the SPAN/RSPAN
destination
. As a result, not all transmit traffic necessarily makes it to a SPAN destination.
Also, the frames that are delivered do not necessarily match the original frames exactly,
depending on policies applied before they are forwarded to the SPAN destination.

Thanks

Karim

Thanks Karim

Could you please link the documentation you are refrerring to?

Regards

Nick

Thanks Karim

Could you please link the documentation you are refrerring to?

Regards

Nick

Hi Nick,

Check out the below link for span and rspan guidelines with explanation on each in cisco 6500 switches

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.1E/native/configuration/guide/span.html

Hope to Help !!

Ganesh.H

You are welcome Nick.

The information comes from "CCIE R&S 4th Edition - Chapter 1" (http://www.ciscopress.com/bookstore/product.asp?isbn=1587059800)

We can also find the information at this non-cisco link : http://www.proprofs.com/flashcards/tableview.php?title=span-rspan

But I suppose the same information is given diffently on this Cisco link :

http://www.ciscosystems.md/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html#wp1059824

For example : A SPAN destination port that is copying traffic  from a single egress SPAN source port sends only egress traffic to the  network analyzer

(meaning after treatment of the packet).

Hope it helps.

Karim

Again, many thanks.

I shall be ordering that book

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco