At a remote site where I can't easily set up SPAN and do a regular packet capture, I need to see the VLAN of incoming frames on a trunk interface. Is there a debug command for a Cisco Catalyst 3560X that will show me the layer 2 header or VLAN of every incoming frame on an interface? Or another approach to identifying the VLAN of incoming frames using only what I have onboard a 3560X?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 1:40

Unfortunately the 3560X does not support packet capture. However, you may be able to use RSPAN (Remote SPAN) to capture traffic on the link.

How this would work is you would configure the remove device with a new VLAN for remote span, and setup a monitor session to go to that remote VLAN.

Any devices in-between that remote VLAN must be trunked and configured. Because of this, RSPAN will not traverse most WAN links (Layer 2 Only).

Example Config for Remote Device:

switch(config)#vlan <#>
switch(config-if)# remote-span
switch(config)#monitor session 2 source interface Gi 0/1
switch(config)monitor session 2 destination remote vlan <#>

Example Config for Device to SPAN to:

switch(config)#vlan <#>
switch(config)#monitor session 2 source remote vlan <#>
switch(config)#monitor session 2 destination interface fa 0/2

You may also be able to use the command: debug vlan packet to see any VLAN tagged packets the device is not configured for. I was not able to confirm if this was available on the 3560, and I do not have one to test.

  • RSPAN is not an option. I would need the capture to cross a layer 3 link. – longneck Apr 28 '16 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.