Solved: Possible SPAN bug in 3560G?

hxmengmetro · ‎07-29-2010

Hi All,

We configured Remote SPAN in one 3560G switches as below:

monitor session 1 source vlan 22 rx

monitor session 1 destination remote vlan 34

monitor session 2 source remote vlan 34

monitor session 2 destination interface gi0/5

The remote vlan 34 carrys the traffic copied from the other switches connected to this 3560G. Gi 0/5 is the sniffer port connected to one PC. I can see the traffic from the other switch on the sniffer port. That means the remote span vlan does copy the traffic from the other switches. But the issue is the traffic in this 3560G switch doesn't get copied to remote vlan 34. The configuration we have is to copy the traffic in vlan 22 in this switch to remote vlan 34 and then copy the data in remote vlan 34 to the sniffer port.

But the configuration like this doesn't work for us. Is this a bug for SPAN or we do something wrong. Please advise. Thanks a lot.

Lou

Jayakrishna Mada · ‎07-30-2010

Lou,

RSPAN is configured in such a way that source session exits on a different switch from destination session. You cannot have a RPSAN source and destination session on the same switch.

This is not a supported configuration and defies the whole purpose of LOCAL SPAN and RSPAN.

if you want to capture the traffic of this switch you just have to use a local span session and use a different destination interface.

Hope that helps.

JayaKrishna

View solution in original post

Jayakrishna Mada · ‎07-30-2010