Hello,

I hope that you can help me figuring out why am I not able to see any EAPoL messages on my remote SPAN port configuration, this is my scenario:

Laptop (authenticating) -- Switch1 -- Switch2 -- Laptop (Monitor)

For more detail scenario
Laptop -- <port g0/2> Switch1 (Cisco 3560-CG) <port g0/10> -- <port g1/0/15> Switch2 (Cisco 3750G) <port g2/0/2>

The configuration from switch1:
monitor session 1 source interface Gi0/1 - 7
monitor session 1 destination remote vlan 101

The configuration from Switch2:
monitor session 2 destination interface Gi2/0/2
monitor session 2 source remote vlan 101

AS you can see I'm using remote span configuration and using remote vlan 101 to carry all my traffic.

When I turn on tshark or wireshark and make a filter eapol or eth.type == 0x888e I can't see anything, no packets coming to that port.

Now what's important to mention is that if I use a local port on the 3560-CG, without any remote span am able to see all the packets, eapol and eth.type... What am I missing, should the cisco SPAN port forward all packets? There are no other commands for the cisco to configure special fields.

Thanks and I hope that someone can help me.

Regards