cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
621
Views
0
Helpful
1
Replies

rspan vlan missing traffic

hansvanz1
Level 1
Level 1
Hi,
I want to capture all traffic in a certain vlan (74) from two switches. I use a remote vlan to accomplish this.
The problem is that I see on the wireshark trace traffic which is traveling from one switch to the other but I don’t see traffic which remains within one switch.
So: 
switch 1: server 1&2
switch 2: server 3&4
all interfaces in the same vlan (74)
remote vlan = vlan 745
connection switch 1 -> switch 2 = trunk (vlan 74 & 745)
action  - on wireshark trace
ping server1 <-> sever 2 - no
ping server1<-> server 3 - yes
ping server 3 <-> server4 - no
I found some examples for the configuration and these are more or less the same as mine; so why is this not working as expected?
 
My config:
Switch 1 (3560)
monitor session 1 source vlan 74 rx
monitor session 1 destination remote vlan 745 
 
switch 2 (4948)
monitor session 1 source vlan 74 rx
monitor session 1 destination remote vlan 745 
monitor session 2 destination interface Gi1/17
monitor session 2 source remote vlan 745
Wireshark pc on port 17
 
Thanks for any help
Hans

 

 

1 Reply 1

stephen.pugh2
Level 1
Level 1

Hi Hans

May I suggest this config for you to try:

switch 1
monitor session 1 source vlan 74 rx
monitor session destination remote vlan 745

switch 2
monitor session 1 source remote vlan 745
monitor session 1 destination interface Gi1/17
monitor session 2 source vlan 74 rx
monitor session 2 destination interface Gi1/17

Cheers

Stephen.