1

I will try to explain my problem ;

I want to see and analyz the traffic in my LAN Network and I configured RSPAN in the Switches. But all ports of my switches uses.So If I mirroring all the traffics to the same port(For View) there will be bandwidth problem.

Is it possible to filter packets which mirrored to Viewing port on Switches ? What should I do ?

Thank you very much!

Edit;

My switch models does not support NetFlow.Because of that I used RSPAN. And for solving the bandwidth problem there are some options;

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/span.html#wp1066836

I decided to use "Specify Vlans to Filter" feature.

Good luck to everyone.

Improve this question
7
  • SPAN and RSPAN are tools to help you troubleshoot network problems. Like debug, you should enable and disable them as you need them. For traffic analysis, there are better tools. Cisco has NetFlow built into most of its devices, and that is designed for what it sounds like you want.
    – Ron Maupin ♦
    Jun 10, 2018 at 20:01
  • But I have to do configuration on switches.Netflow configuration can do just on router, Am I right ?
    – Kaan K
    Jun 10, 2018 at 20:32
  • 1
    No you can do Netflow on almost all new Cisco devices. Few functions can be limited depending on the actual equipment.
    – user36472
    Jun 10, 2018 at 20:50
  • 1
    "But I have to do configuration on switches." Why? We use NetFlow on switches, too. In the old days, we would use SPAN on the switches, and have the collector for SPAN connected to the switch with an interface to collect the traffic, and a different interface someplace else where we could get into the collector to see the traffic. We do that to troubleshoot problems. SPAN/RSPAN/ERSPAN are designed to help you troubleshoot problems, but NetFlow is for traffic analysis. Use the correct tool for the job. Only capture everything when absolutely necessary.
    – Ron Maupin ♦
    Jun 10, 2018 at 20:52
  • but I have just Cisco L2 Switch(Catalyst 2950) !
    – Kaan K
    Jun 10, 2018 at 22:12

1 Answer 1

Reset to default
1

If you insist on using RSPAN to capture all traffic, but you do not want to disrupt production traffic, then you really need to set up a parallel topology for the capture VLAN to send the RSPAN traffic through different interfaces not used for production traffic. Even in that scenario, you will probably lose some RSPAN traffic.

SPAN/RSPAN/ERSPAN are designed to help you troubleshoot your network, and they can be quite disruptive to your production traffic. Much like the Cisco debug commands, you should use it when you are troubleshooting a problem, then disable it when you are not.

There are other tools for traffic analysis, like NetFlow. Cisco has NetFlow built into most of its enterprise-grade equipment. NetFlow is designed for traffic analysis, and it can be configured, tuned, and left up and running all the time.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.