On a on a switch that only support span, and dont support rspan, as long as span only allow destination port to be on the same switch as the source, why cant we connect two switch ports together with a simple straight/cross cable on the same switch, one of the ports - destination for span, another - port for VLAN to traverse the mirrored traffic across the network to another switch. If the two ports are in different VLANs (eg. 10 and 11) and ports are in access mode?
1
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Dec 17, 2020 at 17:32
Add a comment
|
2 Answers
Switches are MAC bridges - they learn source MAC addresses and forward by destination MAC addresses. They don't work like repeater hubs.
If you connect a monitor port to another (production) switch it'll learn all mirrored frames' source MACs on its ingress port, messing up its source address table. Subsequently, it'll forward frames destined for the original source MACs out towards the monitor port - messing up the mirroring switch's source address table as well, or simply get the frames dropped there, depending on the monitor port settings.
Untagged frames can actually be monitored into a port configured for an untagged (and otherwise unused) VLAN. Since the frames are likely flooded to all VLAN ports you'll have to take care that you 'guide' the frame flow to where you want to analyze it and don't congest your production ports with it.
-
Thank you so much for your detailed answer. But correct me if I am wrong - L2 managed switch has a per vlan MAC address table, which means that even if we connect two ports in a different vlans(mirrored and production) - where is the source of mess? Both "per vlan" tables will have similiar mac addresses, but they are separated in switch.– bulkarMay 10, 2020 at 10:39
-
Yes, MAC tables are per VLAN. It all depends on which VLANs you're mirroring and whether they're tagged on the monitor port.– Zac67 ♦May 10, 2020 at 12:47
-
Lets say, I am mirroring VLAN10 to a Ge0/7 on a switch, which is connected to a Ge0/8 - access port for VLAN 20. Further, I transmit VLAN 20 in a trunk port to another switch. Where could be a source of the mess in such a context?– bulkarMay 11, 2020 at 7:56
-
@bulkar That's what I was trying to point out with "guide the frame flow".– Zac67 ♦May 11, 2020 at 16:46
-
There are alternatives to RSPAN your equipment may support. For example, you can use EoMPLS pseudo-wires to transport SPAN traffic around a campus or even global network for analysis.
