i think you got me on the right path!

a quick question, though.

so, i need to create a vlan just for the RSPAN, that's cool, no biggy.

But, do the source ports NEED to be in that vlan or can they be in trunking mode?

the port that i want to monitor is our port to the internet and i can't put it in the rspan vlan.

Thoughts?

The source port stays on its actual Vlan, you don't need to move any ports onto different Vlans.

Assuming you have already created the RSPAN Vlan, you just need to configure the following commands on the switch which has the Internet port:

#monitor session 1 source interface fastethernet 0/1
#monitor session 1 destination remote vlan 900

The source interface above will be your Internet port that you need to monitor and the Vlan ID for the remote VLAN will be your newly created RSPAN Vlan.

Then on the destination switch, i.e the one you have the host who needs to see the packetS:

#monitor session 1 source remote vlan 900
#monitor session 1 destination interface fastethernet 0/10

The source vlan will be the RSPAN vlan and the destination interface will be the port that you want to output your packets to.

Bear in mind that the RSPAN vlan needs to exist in the vlan database of the source switch, the destination switch and all switches in the transit path between them. It also needs to be allowed on all Trunk ports between the source and destination switches.

Thanks

here's what i config-ed:

Source SW:

KWCHSW27#sh mon
Session 1
---------
Type                   : Remote Source Session
Source Ports           :
    Both               : Gi0/51
Dest RSPAN VLAN        : 900

Destination SW:

KWCHSW32#sh monitor
Session 1
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 900
Destination Ports      : Gi0/46
    Encapsulation      : Native
          Ingress      : Enabled, default VLAN = 1
    Ingress encap : Untagged

a couple things i'm concerned about is

my monitoring SW is in a VMWare

and,

the uplink to that VM is an etherchannel on SW32.

Gi0/46 is one of the two ports are paired in the ethercahnnel.  so i picked one, should have i specified both ports as destination ports?

Thanks!!