Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

Triple packet captured in RSPAN

Hi,

I noticed that there was a triple capture on my monitoring console when using RSPAN and would like to find out if there is a way to filter that.

Scenario:

192.168.1.1 pings 192.168.2.1

Traffic was capture on all 3 switches when I monitor the source interfaces. Is there a way to prevent triple capture from happening?

Do take note that I am using routed interfaces and using trunk ports to transport RSPAN vlan traffic.

Attached contains the diagram of the scenario described.

2 REPLIES
Anonymous
N/A

Re: Triple packet captured in RSPAN

RSPAN supports source ports, source VLANs, and destination ports on different switches, which provides remote monitoring of multiple switches across your network.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html#wp1059482

Hall of Fame Super Silver

Re: Triple packet captured in RSPAN

Hello Mun,

I had noticed a double capture in local SPAN when the source is a Vlan.

Here each ICMP packet appears at least twice:

packet sent from PC1

icmp echo request SA 192.168.2.1 DA 192.168.1.1

is received on monitored port on SW1

the packet travels and is sent out port on SW3

this should justify two copies.

From where the third copy comes it is difficult to say.

Hope to help

Giuseppe

121
Views
0
Helpful
2
Replies
CreatePlease to create content