Port Span(Port mirroring)

benghoe · ‎09-26-2010

Hi there,

Does anyone has come across the scenario where your sniffer server is at different location than you Cisco switch. In order to monitor certain switch ports, you put a pair of media converters(UTP to fiber) between the Cisco switch and sniffer server and put the port plug in media converter as port mirroring destination port. At the remote site, does sniffer manage to capture the packets through media converter? I know that certain time you use rspan to achieve this, but I would like to explore whether we can use media converter to do this. Thanks in advance.

best regards,

joe

Jason Masker · ‎09-27-2010

I have not done this for a span specifically, but there is no reason it would not work. A media converter is essentially a layer 1 bridge with segments using different physical media. It is transparent to other network devices in all cases, including in the case of span. I guess I could see one benefit to doing it this way would be that you would keep your span traffic out of band while RSPAN and ERSPAN both send span streams in-band.

glen.grant · ‎09-27-2010

Yes it should work . We did this a number of years ago and it was a number of fiber hops away . As long as there is a valid data path between the switch and the sniffer it should work.

benghoe · ‎09-27-2010

Thanks for all your input, really appreciate it.