RSPAN

My case like this :
I have three switches 2950 within the same subnet connecting with each other with trunk cable as series.
I want to snefer all ports present in the three switches and gather all the data in the one port .If this possible? How ?
Many thanks

check out if the following link on configuirng span/rspan helps :
http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_chapter09186a00803fb0ce.html

Similar Messages

RSPAN is breaking my connection to the Internet

We have two Cisco 2960S switches and I am trying to setup RSPAN to monitor the trunk port to the gateway and send the traffic to a port on the second switch which is setup in a daisy chain. The problem is that every time I enter the monitor session command on the switch to be monitored it shuts down the connection and no one can get to the Internet. I noticed that the reflector command was no longer available in the configuration so I located the newest configuration process I could find and still the same problem. I have found other people in forums with the same issues but they never posted on solutions if they found them. Does anyone have any thoughts on this problem? Also just for clarity, I am trying to monitor traffic in both directions across the trunk. Any thoughts would be greatly appreciated.
Thanks,
Brandon

Hi
My ISP is Earthlink. I don't know what other details you may need. It is a DSL connection. It works great on my one PC but not on my laptop.

How can I use Local SPAN with RSPAN ??

How can I use Local SPAN with RSPAN ??
I want to mirror traffics from ISP-A and ISP-B to Anomaly-detector module.
so I had configured like this...
C6500-A
vlan 1000
name RSPAN
remote-span
monitor session 10 source interface Gi5/1 - 2 rx
monitor session 10 destination remote vlan 1000
monitor session 20 destination anomaly-detector-module 3 data-port 1
monitor session 20 source remote vlan 1000
interface GigabitEthernet1/13
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1000
switchport mode trunk
no ip address
C6500-B
vlan 1000
name RSPAN
remote-span
monitor session 10 source interface Gi5/1 - 2 rx
monitor session 10 destination remote vlan 1000
interface GigabitEthernet1/13
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1000
switchport mode trunk
no ip address
end
but it was not working..
it wasn't any change of input packet hit count when
I'd enter a command 'show anomaly-detector module 3 data-port 1 traffic'
was upper configuration wrong..?
Can I use VACL configuration ?

try to change "monitor session 10 destination remote vlan 1000 " to "monitor session 10 destination anomaly-detector-module 3 data-port 1 " on C6500-A

UCCX 8.0(2) SPAN/RSPAN based VOIP Monitoring

Hi Alll,
UCCX 8.0(2) High Availability (both servers are co-located in data center, where agents and supervisors are in building across the street over fibre)
SRND for UCCX 8 describes that it supports SPAN and/or RSPAN based voip monitoring, which is a requirement for my client as they have CAD Agents running on Citrix thin client and Supervisors on Thick client PCs.
However I am struggling to find a way to achieve this solution for my client with UCCX 8.x, UCCX 7 we would not have had this problem as you can configure 2nd NIC adaptor on UCCX server to be configured as VOIP Monitoring server port/IP under PostInstall and sniff all traffic for all Agent phone devices as configured under CDA.
Desktop Monitoring is not supported for thin client environment. Customer may eventually purchase QM/WFM, but for now we urgently require the essentials of agent monitoring on UCCX.
Please has anybody successfully had this configuration described above achieved? or have any ideas?
Thank you,
Yavuz

Have you been able to get a response to this post? I am running into the exact same issue with an upgrade to UCCx 8.0. SPAN on the 2nd NIC isn't allowed, and now the customer has lost functionality.
Thanks,
Ben

RSPAN Broadcast, impact network intermitten

HI All,
I've configured RSPAN on the customer network.
The impact is, there's a network intermitten on the customer network.
And the source problem is broadcast traffic from the destination port on the RSPAN.
Is anyone found out broadcast problem while configuring RSPAN?
Thansk

Hi Daniel,
Thanks replying.
I'm mirror source from 10 port on one access switch. All the 10 port is connecting 10 IP Phone and 10 PC.
Then the destination port is Server farm switch on port something.
ip phone and pc ---- access switch --- distribution switch --- core switch --- server farm switch --- server recording
After running for several week, we found out network intermitten on the LAN.
Impact is a lot of request time out on when ping to the interface vlan from client pc (on LAN)
The server monitoring found out, broadcast from the source VLAN RSPAN.
I'm wondering to know what is the source problem here, and way to check it out.
Thanks

RSPAN configuration

Hi,
I'm trying to configure a RSPAN with multiple source ports on multiple switches and 1 destination port.
On the first switch I have :
Session 1
Type                   : Remote Source Session
Source Ports           :
    Both               : Po2
Dest RSPAN VLAN        : 400
On the second switch I have :
Session 1
Type                   : Remote Source Session
Source Ports           :
     Both               : Po2
Dest RSPAN VLAN        : 400
Session 2
Type                   : Remote Destination Session
Source RSPAN VLAN      : 400
Destination Ports      : Gi0/7
    Encapsulation      : Native
          Ingress      : Disabled
I don't get any error message, but the counters of interface gi0/7 all remain at 0.
I guess the source & destination RSPAN on the same switch are not supported.
I'm looking for a workaround.
any idea ?
Thanks
Stéph.

Hi Stephane,
The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches. This Vlan is trunked to a remote switch which uses the vlan as the source and a local physical interface as the final destination interface connecting the sniffer.
Keeping this in mind it is impossible for RSPAN to have source and destination on same switch. Also, any interface can be the destination for at most one SPAN session. Hence in your case, its impossible to configure a common destination for the local SPAN and the RSPAN. There have to be at least two different interfaces acting as the destination for these SPAN sessions.
Cheers,
Shashank
Please rate if you found the content useful

SPAN or RSPAN

Hi,
I need to setup port mirroring on Catalyst 4006 switch. Both source and destination port is on the same switch.
I need to capture all traffics across the LAN for analysis. Is it enough by configuring SPAN? Please advise.

Hi Friend,
If your both source and destination port are on a same switch you are good to go with SPAN.
Have a look at this link to configure SPAN on cat4k switch
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/rel7_1/config/span.htm
But as you also said you want to capture traffic acorss the lan in this case the source port may exist on different switches and incase your source port and destination port exist on different switch then you surely need a RSPAN.
Also instead of configuring a specific source port to capture you can capture complete vlan when you configure SPAN you can also configure source vlan to capture all traffic on and for that vlan.
HTH, if yes please rate the post.
Ankur

SPAN/RSPAN issues

Hi All,
I'm looking in to a problem regarding slow response to a file server, post implementation of RSPAN source changes.
SCENARIO
The LAN is a stack of 2/3 3750's on each floor, with a data Vlan per floor and a network wide voice Vlan 300. These access switches are gig fibre connected to two core switches, 6506's. Nortel IP handsets have been deployed and the voice Vlan 300 is being SPAN'ed to record to an IP voice recorder server. No problems there.
However, now there are Softphones deployed on various PC's and in order to facilitate staff relocation throughout the building, WITHOUT having to reconfigure any switch ports each time, the Data Vlan on each floor has also been specified as a source.
Having put additional config in to capture the data Vlan, there appears to be slow response when accessing a file server on a different Vlan. A ping -t that runs while copying a file to the Win 2003 file server actually drops and the copy hangs. If you try this again having either suspended the access switch RSPAN or shifting the file server to the other core switch, it seems to be OK and the difference in the ping response is very apparent
QUESTION
Has anyone come across any performance problems such as this and if so could you shed some light please?
Here's the config from only one of the floors:
DATA Vlan 112
VOICE Vlan 300
Remote SPAN dest Vlan 30
monitor session 1 source vlan 112 , 300
monitor session 1 destination remote vlan 30
Here's the config from the core switch where the voice recorder sits;
interface GigabitEthernet4/2
description *** SPAN destination for Witness CSS01 NIC 1 ***
no ip address
speed 100
duplex full
switchport
spanning-tree portfast
monitor session 1 destination interface Gi4/2
monitor session 1 source remote vlan 30
Kind Regards
Ali

Hello Ali,
I expirienced trouble with 3750 using 1000-BASE-SX and 1000-BASE-LH lasers that gave poor peformance with file transfers.
This was the case on switches that had MLS QoS enabled for IP phones.
The symptoms are described in bug toolkit CSCeg29704. There is a workaround. Upgrading to 12.2(25)SED or higher resolves the problem.
Release Notes
After enabling QOS on 3750 and 3560 switches, certain application (mostly bursty
and TCP based) experience significant performance degradation due to unexpected
packet drops on some of the egress queues.
This is due to initial default egress queue threshold settings
(when qos enabled) not optimized for this type of traffic pattern.
This initial default queue threshold settings (when qos enabled)
thus need to be changed to accommodate these traffic.
Workaround:
Tune the egress queue thresholds parameters to
allocate more to the affected queues.
Specifically, egress queue 2 thresholds need to have the following settings:
Thresholds1 = 200
Thresholds2 = 200
Reserved = 50
Maximum = 400
e.g.
mls qos queue-set output 1 threshold 2 200 200 50 400
mls qos queue-set output 2 threshold 2 200 200 50 400
HTH
Leon
* Please rate useful posts.

RSPAN does not put IPv6 multicast traffic into port

Hi.
There is two switches in the equation:
WS-C2960-24TT-L 12.2(55)SE5 C2960-LANBASEK9-M
and stack of
Switch Ports Model SW Version SW Image
1 12 WS-C3750G-12S 12.2(55)SE8 C3750-IPSERVICESK9-M
2 12 WS-C3750G-12S 12.2(55)SE8 C3750-IPSERVICESK9-M
* 3 24 WS-C3750G-24T 12.2(55)SE8 C3750-IPSERVICESK9-M
3 is a master
There is VTP domain with pruning off and RSPAN VLAN 1001
core#sho vlan remote-span
Remote SPAN VLANs
1001
there is RSPAN session on first:
#sho monitor session 1
Session 1
Type : Remote Source Session
Source Ports :
Both : Fa0/11
Dest RSPAN VLAN : 1001
Port Fa0/11 is in access mode, VLAN 303
and on second:
core#sho monitor session 1
Session 1
Type : Remote Destination Session
Source RSPAN VLAN : 1001
Destination Ports : Gi3/0/2
Encapsulation : Native
Ingress : Disabled
Problem is that i can't see any IPv6 multicast traffic (like ICMPv6 RA or such) on Gi3/0/2 which is absolutely sure there, because if i remove monitoring session on core switch and put Gi3/0/2 into trunk mode, i can see packets i need in vlan 1001:
# tcpdump -s0 -nnvei eth1 vlan 1001 and ip6
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
14:17:37.059045 50:57:a8:f0:72:1b > 33:33:ff:00:00:01, ethertype 802.1Q (0x8100), length 90: vlan 1001, p 0, ethertype IPv6, (class 0xe0, hlim 255, next-header ICMPv6 (58) payload length: 32) 2abc:abc:1:600b::2 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2abc:abc:1:600b::1
source link-address option (1), length 8 (1): 50:57:a8:f0:72:1b
14:17:38.083266 50:57:a8:f0:72:1b > 33:33:ff:00:00:01, ethertype 802.1Q (0x8100), length 90: vlan 1001, p 0, ethertype IPv6, (class 0xe0, hlim 255, next-header ICMPv6 (58) payload length: 32) 2abc:abc:1:600b::2 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2abc:abc:1:600b::1
source link-address option (1), length 8 (1): 50:57:a8:f0:72:1b
14:17:39.107068 50:57:a8:f0:72:1b > 33:33:ff:00:00:01, ethertype 802.1Q (0x8100), length 90: vlan 1001, p 0, ethertype IPv6, (class 0xe0, hlim 255, next-header ICMPv6 (58) payload length: 32) 2abc:abc:1:600b::2 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2abc:abc:1:600b::1
source link-address option (1), length 8 (1): 50:57:a8:f0:72:1b
There is no such problem with usual unicast and broadcast traffic.
Any suggestions?

Interestingly, i've found bug CSCsr64007 which i stubmbled upon on one of my switches during troubleshooting. The effect of this bug was that RSPAN took IPv6 multicast packets from unrelated VLANs and forwarded them into monitor port.
Looks like they have "fixed" it filtering IPv6 multicast completely.

RSPAN Configuration Problem

Hi all,
I'm having some difficulties setting up an RSPAN to work from a specific remote office.
I have the config working for our main head office and another remote office which tells me that its probably something in the remote switch configuration, but any pointed in the right direction would be great.
Remote Office Remote VLAN:
nlh_mar1_f20_cs1#show vlan remote-span
Remote SPAN VLANs
99
Remote Office RSPAN:
nlh_mar1_f20_cs1#show monitor
Session 1
Type : Remote Source Session
Source VLANs :
Both : 216
Dest RSPAN VLAN : 99
Remote office RSPAN config:
monitor session 1 source vlan 216
monitor session 1 destination remote vlan 99
Remote office trunk to Head Office:
interface FastEthernet0/8
switchport trunk encapsulation dot1q
switchport trunk native vlan 66
switchport trunk allowed vlan 10,16,66,99,900,998,1000
switchport mode trunk
speed 100
duplex full
priority-queue out
mls qos trust dscp
end
Head office trunk to remote office:
interface GigabitEthernet3/0/14
switchport trunk encapsulation dot1q
switchport trunk native vlan 66
switchport trunk allowed vlan 10,16,66,99,900,998,1000
switchport mode trunk
speed 100
duplex full
priority-queue out
end
Head Office RSPAN:
HO-Core#show monitor
Session 2
Type : Remote Destination Session
Source RSPAN VLAN : 99
Destination Ports : Gi2/0/9
Encapsulation : Native
Ingress : Disabled
Head Office RSPAN config:
monitor session 2 destination interface Gi2/0/9
monitor session 2 source remote vlan 99
Head Office RSPAN VLAN:
HO-Core#show vlan remote-span
Remote SPAN VLANs
99
Ryan

Hi - has anyone seen something similar to this happen before?

SPAN or RSPAN Configuration for intermediate Switch.

Hi
I am having three switches. My Sniffer is connected with my Core Switche port 11.
I am having 1 core SW, 2 Access SW.
CoreSW --------------Trunk--------------->AccessSw1-----------------Trunk-------------------------AccessSw2.
I am trying to configure Monitor session between AccessSW2 and Core SW.
my configuration ar Core SW
monitor session 1 destination interface Fa0/11
monitor session 1 source remote vlan 901
At AssessSw2
monitor session 1 source interface Fa0/1 - 22
monitor session 1 destination remote vlan 901
these configurations work fine if I ommit AccessSw1.
So what Configuration I need at AccessSW1 to communicate fine. Please help me on this..

Alexander,
You will have to specify the remote vlan on Sw2, just creating it won't help. Following is the config for the SW2.
Switch(config)# monitor session 1 source remote vlan 901Switch(config)# monitor session 1 destination interface fastEthernet0/5
The commands are a bit platform specific, as they are a bit different for the 6500 switches:
For SW2 on Cisco6500
Router(config)# monitor session 1 type rspan-destination
Router(config-rspan-dst)# source remote vlan 2
Router(config-rspan-dst)# destination interface gigabitethernet 1/2
Thanks
Ankur
"Please rate the post if found useful"

SPAN and RSPAN, ISL and TRUNKING

Hello,
I have some questions regarding the do's and don'ts of SPANNING. If you have for example several switches with one port, say port 48 SPANNED to another switch that collapses all the traffic to be monitored by an IDS or network analyzer.
What would be the best way to do this if you were concerned about multiple VLAN's being on the switches you were SPANNING from?
My idea was to turn each of the SPAN ports into a TRUNK PORTS and also use ISL encapsulation between the switches and the âAggregate Switchâ that everything collapses to. Then, I would have a Monitor Session âAnother SPAN taking all of those SPAN's for the other switches to a single port for monitoring.
This was because on each of the switches have TRUNKED 802.1q FIBER PORTS and are capable of receiving any VLAN. Also, although 802.1q is common, for this I was thinking of using ISL because it does not require a Native VLAN. If a port on the switch is changed to a different VLAN (Switch Port Access VLAN XX) and the Monitor âSPANâ is not set for TRUNKING, I don't think we would see that traffic from a different VLAN would we?
RSPAN could be used but there are already physical SPAN's coming from each of the switches to monitor. Is there any down side to using physically cabled SPAN's vs RSPAN?
What is the best practice for monitoring segregated networks that cannot use RSPAN? Physically cabled SPAN's with Monitor Sessions?
Am I thinking of this correctly or have I derailed?
Thanks

If you have source ports belonging to several different VLANs, or if you are using SPAN on several VLANs on a trunk port, you may want to identify to which VLAN a packet you are receiving on the destination SPAN port belongs. This is possible by enabling trunking on the destination port before configuring it for SPAN. This way, all packets forwarded to the
sniffer will also be tagged with their respective VLAN IDs.

[rspan in 'hub+spoke' topology]

Hi,
I have the topology depicted in the attached drawing.
What we want to achieve is to enable rspan to replicate monitored traffic from access switches (3550 spokes) to a core switch (6500 hub).
The configuration in general is working and looks like this:
HUB:
monitor session 1 destination interface Gix/y
monitor session 1 source remote vlan z
SPOKES:
monitor session 1 source interface Gix/y
monitor session 1 destination remote vlan z
As stated previosly the environment is working, but...we're having one problem. The uplinks from the spokes to the hub are almost full. After doing some troubleshooting, we found that span traffic is being replicated by the hub to the spokes. The reason I say this is that when i remove the rspan vlan (on the core switch) from the uplink to the hubs the output traffic from core to access (or input on the access switches) goes down in the same amount being received by the network analyzer. when i add the vlan on the uplink trunk again, the traffic going out of the core to the access switches goes up by the same amount being sent to the network analyzer.
Like i said, the rspan part seems to be working fine, but the uplinks to the access switches are getting full because the hub switch is copying the span traffic to all uplinks which is not what we want.
Two questions here:
1.- Is this the way rspan is supposed to work in this environment?
2.- if not, is there a way to turn off this behavior or does it sound like a bug to you?
Thanks in advance!
c.

Hello,
in Hub and Spoke - as in any other L3VPN - traffic will flow in the opposite direction of IP routing updates. In a Hub and Spoke setup the spoke sites should get routing updates from the hub site. Thus one faces a split horizon problem: updates learned at the hub CE from a neighbor (PE) will not be sent back over the same interface to that neighbor. Hence the simple solution is: one VRF and interface to announce spoke routes from the PE to the hub CE and another interface terminating in a second VRF to announce the routes from the hub CE back into the MPLS VPN environment.
Just as a side note: this results in an unusual load pattern on the two hub CE interfaces. Both interfaces will have nearly only load in one direction.
Hope this helps! Please rate all posts.
Regards, Martin

Why cant see the video flow by rspan

on the sw (Catalyst 4500 L3 Switch Software (cat4500-IPBASE-M), Version 12.2(31)SGA2),use the rspan to sniffer the video netflow,but the sniffer cant capture the flow,why.
the configure like this
vlan 500 is the rspan vlan.
on the first 45 sw config:
monitor session 2 sour interface f0/9(the port conn to polycom terminal)
monitor session 2 dest remote vlan 500
on the other 45sw config:
monitor session 2 sour remote vlan 500
monitor session 2 dest interface f0/10(the port connect to pc with sniffer)
pls take me why

If those video files have the extension .mov, .mp4 or .m4v at the end of the file name, Quicktime should be able to play them. If those video files don't have one of those extensions attached to them, you can add it manually.
Luckily, there are HUNDREDS of video/media players and Extensions, avaliable for the Mac, many of them FREE. Some of them are...
     Perian
     http://perian.org/
     Quicktime 7.6.6
     http://support.apple.com/kb/DL923
     VLC
     http://www.videolan.org/vlc/index.html
     NicePlayer
     http://www.macupdate.com/app/mac/15136/niceplayer
And if that still doesn't work, there is a possibility that those video files may be corrupted.

Another damn RSPAN problem

Guys, RSPAN seems to be a pretty common topic here and I was wondering if someone can help me. I have poured over the documents and forums, but I cannot see why my setup won’t work.
Basic overview time, 2 Cat 4507Rs (swc3b and swc230) connected via isl trunk. All vlans allowed on trunk.
RSPAN vlan 109 has been setup on vtp server and propagated to all switches.
Config as follows:
SWC230:
monitor session 1 source interface Fa4/47 [PC I want to sniff is in f4/47]
monitor session 1 destination remote vlan 109
SWC3B:
monitor session 1 source vlan 109
monitor session 1 destination interface Gi7/18
[sniffer is connected in g7/18]
IOS on both switches is Version 12.2(20)EW.
I have tried a few permutations with the configuration: putting swc3b g7/18 into remote vlan 109, taking it out again; putting a port on SWC230 into vlan 109 (switchport access vlan 109), in the hope that this was would function as a ‘reflector port’.
Nothing works. I have noticed that vlan 109 is pruned on the trunk between swc230 > swc3b. That was kinda why I tried putting a port on swc230 into vlan 109.
Any advice gratefully received.

Amit, thanks for the response, but I've cracked it. All that was missing was 'remote' from the source command on swc3b i.e.
monitor session 1 source REMOTE vlan 109
Once this was done, it worked like a charm.

2950 RSPAN problem

Hello all,
I have read various threads about using RSPAN with 2950 switches, but I am still unable to get it to work.
The source, destination and 2 intermediate switches are all C2950G-24-EI running 12.1(20)EA1a.
On all switches I have created vlan 480:
vlan 480
name RSPAN-vlan
remote-span
On the source I have:
monitor session 1 source interface fastEthernet0/14 rx
monitor session 1 destination remote vlan 480 reflector-port fastEthernet0/6
On the destination:
monitor session 1 source remote vlan 480
monitor session 1 destination interface fastEthernet0/11
Ideally I want both tx and rx on the source, but after reading a previous thread I am just trying to get rx.
"- Scenario1 (2950's as source, destination, and intermidiate switches):
RSPAN is supported if there is 1 source port, and the SPAN session is
configured as RX only or TX only. "
If I generate excessive traffic to the source port, I can see this on the link graph for the trunk port of the destination switch, but not on the final port itself.
Can anyone suggest anything that I can try to resolve this?
Regards,
-Jeff

Hello all,
I have read various threads about using RSPAN with 2950 switches, but I am still unable to get it to work.
The source, destination and 2 intermediate switches are all C2950G-24-EI running 12.1(20)EA1a.
On all switches I have created vlan 480:
vlan 480
name RSPAN-vlan
remote-span
On the source I have:
monitor session 1 source interface fastEthernet0/14 rx
monitor session 1 destination remote vlan 480 reflector-port fastEthernet0/6
On the destination:
monitor session 1 source remote vlan 480
monitor session 1 destination interface fastEthernet0/11
Ideally I want both tx and rx on the source, but after reading a previous thread I am just trying to get rx.
"- Scenario1 (2950's as source, destination, and intermidiate switches):
RSPAN is supported if there is 1 source port, and the SPAN session is
configured as RX only or TX only. "
If I generate excessive traffic to the source port, I can see this on the link graph for the trunk port of the destination switch, but not on the final port itself.
Can anyone suggest anything that I can try to resolve this?
Regards,
-Jeff

RSPAN

Similar Messages

Maybe you are looking for