We have one layer 3 switch. Configured monitor session to copy all the data in vlan 2 ports (RX only) to one sniffer port. There is one interface in this switch configured as a router interface. As I know router interface doesn't carry vlan information, but from what I have seen, the packet coming through router interface did get copied to sniffer port. So when the packet comes through router interface, the switch adds vlan 2 tag for that packet if they decide to route it to vlan 2? The SPAN just think it's incoming vlan 2 data, so it copys it to the sniffer port. Am I right?
You are correct. I guess you are seeing the packet after the packet enters VLAN 2. Typically within the switch, you do not tag the traffic. If the switch decides that the destination is on a different switch and the packet needs to traverse through a trunk interface, then it will attach the tag. If you SPAN the trunk interface as well, then it will send the tag information to the sniffer. You might also see the tag if you configure "encapsulation replicate" in your SPAN configuration.
[toc:faq]The ProblemOn traditional switches whenever we have a trunk
interface we use the VLAN tag to demultiplex the VLANs. The switch needs
to determine which MAC Address table to look in for a forwarding
decision. To do this we require the switch to do...
[toc:faq]Introduction:Netdr is a tool available on a RSP720, Sup720 or
Sup32 that allows one to capture packets on the RP or SP inband. The
netdr command can be used to capture both Tx and Rx packets in the
software switching path. This is not a substitut...
IntroductionOSPF, being a link-state protocol, allows for every router
in the network to know of every link and OSPF speaker in the entire
network. From this picture each router independently runs the Shortest
Path First (SPF) algorithm to determine the b...