On a on a switch that only support span, and dont support rspan, as long as span only allow destination port to be on the same switch as the source, why cant we connect two switch ports together with a simple straight/cross cable on the same switch, one of the ports - destination for span, another - port for VLAN to traverse the mirrored traffic across the network to another switch. If the two ports are in different VLANs (eg. 10 and 11) and ports are in access mode?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17, 2020 at 17:32

2 Answers 2


Switches are MAC bridges - they learn source MAC addresses and forward by destination MAC addresses. They don't work like repeater hubs.

If you connect a monitor port to another (production) switch it'll learn all mirrored frames' source MACs on its ingress port, messing up its source address table. Subsequently, it'll forward frames destined for the original source MACs out towards the monitor port - messing up the mirroring switch's source address table as well, or simply get the frames dropped there, depending on the monitor port settings.

Untagged frames can actually be monitored into a port configured for an untagged (and otherwise unused) VLAN. Since the frames are likely flooded to all VLAN ports you'll have to take care that you 'guide' the frame flow to where you want to analyze it and don't congest your production ports with it.

  • Thank you so much for your detailed answer. But correct me if I am wrong - L2 managed switch has a per vlan MAC address table, which means that even if we connect two ports in a different vlans(mirrored and production) - where is the source of mess? Both "per vlan" tables will have similiar mac addresses, but they are separated in switch.
    – bulkar
    May 10, 2020 at 10:39
  • Yes, MAC tables are per VLAN. It all depends on which VLANs you're mirroring and whether they're tagged on the monitor port.
    – Zac67
    May 10, 2020 at 12:47
  • Lets say, I am mirroring VLAN10 to a Ge0/7 on a switch, which is connected to a Ge0/8 - access port for VLAN 20. Further, I transmit VLAN 20 in a trunk port to another switch. Where could be a source of the mess in such a context?
    – bulkar
    May 11, 2020 at 7:56
  • @bulkar That's what I was trying to point out with "guide the frame flow".
    – Zac67
    May 11, 2020 at 16:46
  • Thanks alot. As a conclusion,is this scheme realistic?
    – bulkar
    May 12, 2020 at 7:05

There are alternatives to RSPAN your equipment may support. For example, you can use EoMPLS pseudo-wires to transport SPAN traffic around a campus or even global network for analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.