0

On a on a switch that only support span, and dont support rspan, as long as span only allow destination port to be on the same switch as the source, why cant we connect two switch ports together with a simple straight/cross cable on the same switch, one of the ports - destination for span, another - port for VLAN to traverse the mirrored traffic across the network to another switch. If the two ports are in different VLANs (eg. 10 and 11) and ports are in access mode?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 17 '20 at 17:32
3

Switches are MAC bridges - they learn source MAC addresses and forward by destination MAC addresses. They don't work like repeater hubs.

If you connect a monitor port to another (production) switch it'll learn all mirrored frames' source MACs on its ingress port, messing up its source address table. Subsequently, it'll forward frames destined for the original source MACs out towards the monitor port - messing up the mirroring switch's source address table as well, or simply get the frames dropped there, depending on the monitor port settings.

Untagged frames can actually be monitored into a port configured for an untagged (and otherwise unused) VLAN. Since the frames are likely flooded to all VLAN ports you'll have to take care that you 'guide' the frame flow to where you want to analyze it and don't congest your production ports with it.

7
  • Thank you so much for your detailed answer. But correct me if I am wrong - L2 managed switch has a per vlan MAC address table, which means that even if we connect two ports in a different vlans(mirrored and production) - where is the source of mess? Both "per vlan" tables will have similiar mac addresses, but they are separated in switch. – bulkar May 10 '20 at 10:39
  • Yes, MAC tables are per VLAN. It all depends on which VLANs you're mirroring and whether they're tagged on the monitor port. – Zac67 May 10 '20 at 12:47
  • Lets say, I am mirroring VLAN10 to a Ge0/7 on a switch, which is connected to a Ge0/8 - access port for VLAN 20. Further, I transmit VLAN 20 in a trunk port to another switch. Where could be a source of the mess in such a context? – bulkar May 11 '20 at 7:56
  • @bulkar That's what I was trying to point out with "guide the frame flow". – Zac67 May 11 '20 at 16:46
  • Thanks alot. As a conclusion,is this scheme realistic? – bulkar May 12 '20 at 7:05
0

There are alternatives to RSPAN your equipment may support. For example, you can use EoMPLS pseudo-wires to transport SPAN traffic around a campus or even global network for analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.