On a on a switch that only support span, and dont support rspan, as long as span only allow destination port to be on the same switch as the source, why cant we connect two switch ports together with a simple straight/cross cable on the same switch, one of the ports - destination for span, another - port for VLAN to traverse the mirrored traffic across the network to another switch. If the two ports are in different VLANs (eg. 10 and 11) and ports are in access mode?


Switches are MAC bridges - they learn source MAC addresses and forward by destination MAC addresses. They don't work like repeater hubs.

If you connect a monitor port to another (production) switch it'll learn all mirrored frames' source MACs on its ingress port, messing up its source address table. Subsequently, it'll forward frames destined for the original source MACs out towards the monitor port - messing up the mirroring switch's source address table as well, or simply get the frames dropped there, depending on the monitor port settings.

Untagged frames can actually be monitored into a port configured for an untagged (and otherwise unused) VLAN. Since the frames are likely flooded to all VLAN ports you'll have to take care that you 'guide' the frame flow to where you want to analyze it and don't congest your production ports with it.

| improve this answer | |
  • Thank you so much for your detailed answer. But correct me if I am wrong - L2 managed switch has a per vlan MAC address table, which means that even if we connect two ports in a different vlans(mirrored and production) - where is the source of mess? Both "per vlan" tables will have similiar mac addresses, but they are separated in switch. – bulkar May 10 at 10:39
  • Yes, MAC tables are per VLAN. It all depends on which VLANs you're mirroring and whether they're tagged on the monitor port. – Zac67 May 10 at 12:47
  • Lets say, I am mirroring VLAN10 to a Ge0/7 on a switch, which is connected to a Ge0/8 - access port for VLAN 20. Further, I transmit VLAN 20 in a trunk port to another switch. Where could be a source of the mess in such a context? – bulkar May 11 at 7:56
  • @bulkar That's what I was trying to point out with "guide the frame flow". – Zac67 May 11 at 16:46
  • Thanks alot. As a conclusion,is this scheme realistic? – bulkar May 12 at 7:05

There are alternatives to RSPAN your equipment may support. For example, you can use EoMPLS pseudo-wires to transport SPAN traffic around a campus or even global network for analysis.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.