Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

RSPAN woes

Hi

I have just set a RSPAN vlan and some ports to monitor but dont seem to be receiving any IP traffic. I can see the MAC addresses of hosts im trying to monitor across the RSPAN vlan.

Any ideas ?

Cheers

switch with sniffer connected

Session 1

---------

Type : Remote Destination Session

Source RSPAN VLAN: 900

Destination Ports : Fa0/32

Encapsulation : Native

Ingress: Disabled

switch with hosts trying to monitor

Rspan Type : Source

Destination : -

Reflector : Port 2/48

Rspan Vlan : 900

Admin Source : Port 2/2

Oper Source : Port 2/2

Direction : transmit/receive

Incoming Packets: -

Learning : -

Filter : -

Status : active

6 REPLIES
Hall of Fame Super Bronze

Re: RSPAN woes

Can you post

show run | i monitor

from each switch ?

Hall of Fame Super Gold

Re: RSPAN woes

Stephen

Is there a trunk configured between the switches that is configured to carry VLAN 900? There needs to be a trunk between the switches for the RSPAN VLAN.

HTH

Rick

Community Member

Re: RSPAN woes

Hi Rick

VLAN900 is allowed accross the trunk, I can see the MAC address of the host im trying to capture.

config as below

Host monitor switch

#switch port analyzer

set rspan source 2/2 900 both reflector 2/48 create

Switch with Sniffer connected

monitor session 1 destination interface Fa0/32

monitor session 1 source remote vlan 900

Hall of Fame Super Gold

Re: RSPAN woes

Stephen

Thanks for the additional information. Perhaps you can also post the configuration of the trunk on both switches. It might also be helpful if you would post the output of show trunk on both switches.

HTH

Rick

Community Member

Re: RSPAN woes

Hi

Outputs for show trunk

Switch with sniffer connected

Port Mode Encapsulation Status Native vlan

Gi0/1 on 802.1q trunking 1

Gi0/2 on 802.1q trunking 1

Port Vlans allowed on trunk

Gi0/1 1-4094

Gi0/2 1-4094

Port Vlans allowed and active in management domain

Gi0/1 1,10-11,40,50,900,999

Gi0/2 1,10-11,40,50,900,999

Port Vlans in spanning tree forwarding state and not pruned

Gi0/1 1,10-11,40,50,900,999

Gi0/2 1,10-11,40,50,900,999

switch with hosts

Port Mode Encapsulation Status Native vlan

-------- ----------- ------------- ------------ -----------

2/49 on dot1q trunking 1

Port Vlans allowed on trunk

-------- ---------------------------------------------------------------------

2/49 1-1005,1025-4094

Port Vlans allowed and active in management domain

-------- ---------------------------------------------------------------------

2/49 1,10-12,15-16,20,50,60,90,102,230,900

Port Vlans in spanning tree forwarding state and not pruned

-------- ---------------------------------------------------------------------

2/49 1,10-12,15-16,20,50,60,90,102,230,900

mpc
Community Member

Re: RSPAN woes

Do you have the VLAN 900 defined as "remote-span" ?

IE:

switch(config)# vlan 900

switch(config-vlan)# remote-span

Also, RSPAN on 2950 supports either Tx or Rx, but not Tx/Rx together for some reason.

P.

153
Views
0
Helpful
6
Replies
CreatePlease to create content