User Tools

Site Tools


tech:network:cisco:span-rspan:span-rspan

Cisco: Packet Capture: SPAN, RSPAN

Blueprint

      • 4.0 Network Assurance
        • 4.4 Configure and verify SPAN/RSPAN/ERSPAN
      • 4.0 Infrastructure Security and Services
        • 4.7 Network operations
          • 4.7.a Traffic capture
            • 4.7.a i SPAN
            • 4.7.a ii RSPAN
      • 2.0 Layer 2 Technologies
        • 2.1 LAN switching technologies
          • 2.1.g Implement and troubleshoot other LAN switching technologies
            • 2.1.g [i] SPAN, RSPAN, ERSPAN
      • 1.0 Layer 2 Technologies
        • 1.1 LAN switching technologies
          • 1.1.g Implement and troubleshoot other LAN switching technologies
            • 1.1.g [i] SPAN, RSPAN, ERSPAN

Base Configuration

Physical Lab

R1 Lab Base Configuration

R2 Lab Base Configuration

R3 Lab Base Configuration

SW1 Lab Base Configuration

SW2 Lab Base Configuration

SW3 Lab Base Configuration

Local SPAN Lab

  • ✔SW1
configure terminal
!
monitor session 1 source interface FastEthernet 1/0/1
monitor session 1 destination interface FastEthernet 1/0/12
!
end
  • ✔SW1
configure terminal
!
monitor session 1 source interface FastEthernet 1/0/1 tx
monitor session 1 destination interface FastEthernet 1/0/12
!
end
  • ✔SW1
configure terminal
!
monitor session 1 source interface FastEthernet 1/0/1 rx
monitor session 1 destination interface FastEthernet 1/0/12
!
end

to monitor 802.1Q tag, see Capture IEEE802.1Q Frame with Wireshark

  • ✔SW1
configure terminal
!
monitor session 1 source interface FastEthernet 1/0/1
monitor session 1 destination interface FastEthernet 1/0/12 encapsulation replicate
!
end
  • ✔SW1
configure terminal
!
monitor session 1 source vlan 128
monitor session 1 destination interface FastEthernet 1/0/12
!
end
  • ✔SW1
configure terminal
!
monitor session 1 source interface FastEthernet 1/0/1
monitor session 1 destination interface FastEthernet 1/0/11, FastEthernet 1/0/12
!
end
  • ✔SW1
configure terminal
!
monitor session 1 source interface FastEthernet 1/0/1
monitor session 1 destination interface FastEthernet 1/0/11, FastEthernet 1/0/12 encapsulation replicate
!
end
  • ✔SW1(filter vlan)
configure terminal
!
monitor session 1 source interface FastEthernet 1/0/1
monitor session 1 filter vlan 1 , 128 - 129
monitor session 1 destination interface FastEthernet 1/0/12 encapsulation replicate
!
end
  • ✔SW1(filter vlan)
configure terminal
!
monitor session 1 source interface FastEthernet 1/0/1
monitor session 1 filter vlan 1 , 128 , 130
monitor session 1 destination interface FastEthernet 1/0/12
!
end

SW1 Console Log

Remote SPAN(RSPAN) Lab

  • ✔SW1
configure terminal
!
vlan 999
 remote-span
exit
!
monitor session 1 source interface FastEthernet 1/0/1
monitor session 1 destination remote vlan 999
!
end

RSPAN seems to be not work encapsulation replicate, any tags stripped.

  • ✔SW2
configure terminal
!
vlan 999
 remote-span
exit
!
monitor session 1 source remote vlan 999
monitor session 1 destination interface FastEthernet 1/0/12 encapsulation replicate
!
end

SW2 mis-configuration

SW3 mis-configuration

SW2 Configuration Log

SW2 rejected multiple switch RSPAN…

Fa1/0/1 - SW1 - SW2 - SW3 - Wireshark

Let's reference CCO(cisco.com)

References

tech/network/cisco/span-rspan/span-rspan.txt · Last modified: 2019/11/12 08:22 by wnoguchi