5

Situation: We have a 3750 with a monitoring session setup on it, grabs a few VLAN's running over the switch and has a destination port on that device (normal SPAN not RSPAN). Historically speaking - that destination port had a 1GB cable plugged into it connecting down to a 3020 (in the back of an HP blade chassis), and hosts in that chassis could be set with a promiscuous NIC to monitor the network.

The 3020 has lost it's config. How do I set up the port on the 3020 to pass the SPAN traffic? Very curious about this because I had thought RSPAN was needed for a setup like this, but it's worked for years in the manner described above with regular SPAN.

Improve this question
1
  • RSPAN does nothing else at all, but stop MAC learning in given VLAN, causing frames to be flooded to all allowed ports. Without RSPAN as long as you're not doing tx+rx mirroring, it'll be flooded the same way, as DMAC is never learned from any port.
    – ytti
    Aug 5 '13 at 7:07
6

A back-to-back SPAN session would seem to work. I can't say that is what was used in your environment but I just labbed it up and it worked with no problems. I was able to capture packets on the laptop that were from the gi0/7 interface on the 2960G. A poor mans RSPAN.

Test layout and configurations below. No special configuration on the switchports at all, just our leftover lab stuff.

rest-of-world ======== [gi0/7]2960G[gi0/2] ====== [fa1/0/1]3750-24[fa1/0/2] =========== laptop

2960G
====================
!
interface GigabitEthernet0/2
 switchport access vlan 705
 switchport mode access
 switchport nonegotiate
 spanning-tree portfast
!
interface GigabitEthernet0/7
 description Trunk to rest of world
 switchport trunk allowed vlan 1,4,113,125,130,132,270,420,444,655,705,998
 switchport mode trunk
 switchport nonegotiate
 logging event trunk-status
!
monitor session 1 source interface Gi0/7
monitor session 1 destination interface Gi0/2
!

3750-24
=======================
!
interface FastEthernet1/0/1
 switchport access vlan 777
 spanning-tree portfast
!
interface FastEthernet1/0/2
 switchport access vlan 777
 spanning-tree portfast
!
monitor session 1 source interface Fa1/0/1
monitor session 1 destination interface Fa1/0/2
!

Edit: Does not work with "encapsulation replicate" on the monitor destination command.

Improve this answer
1
  • Hah very cool!! Thanks for this! Going to leave unanswered for a bit and see if anyone else comes up with something different, otherwise will mark answered then.
    – A L
    Aug 2 '13 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.