tema Capturing traffic flows from 3750 to 6509 then to Netflow en Switching

Capturing traffic flows from 3750 to 6509 then to Netflow

Zubair.Sayed_2 — Thu, 07 Mar 2019 16:11:08 GMT

Hi fellow networkers,

I am aware that the 3750 switches are not able to support Netflows, so I have created a SPAN port and spanning traffic from a specific port.

I would like to create a seperate VLAN and trunk the traffic from the SPAN port down to the 6509 switch and then capture all the traffic for that VLAN on the 6509.

Will this work or does anybody else have any other suggestions?

Regards

Zubair

Capturing traffic flows from 3750 to 6509 then to Netflow

Edison Ortiz — Tue, 07 Aug 2012 14:30:50 GMT

Yes, that's called RSPAN

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_50_se/configuration/guide/swspan.html

Capturing traffic flows from 3750 to 6509 then to Netflow

Zubair.Sayed_2 — Wed, 08 Aug 2012 06:09:31 GMT

Thanks Edison.

I will give this a try and update thread.

Reading through the notes I need to configure my source RSPAN port on the 3750 along with the vlan's etc and then set the destination as the trunk link to the 6509.

I then configure the trunk link to filter that specific vlan and what confuses me is how do I then forward traffic to Netflow, I am assuming I would require a physical interface and not a L3 vlan?

Regards

Capturing traffic flows from 3750 to 6509 then to Netflow

Zubair.Sayed_2 — Wed, 08 Aug 2012 06:44:13 GMT

Edison,

I have another question, I went through the document, very helpful indeed but I am stuck at the point where I am creating the RSPAN Destination Session and Step 7 says "For interface-id, specify the destination interface. The destination interface must be a physical interface."

Can I use any available physical interface ?

Thanks

Capturing traffic flows from 3750 to 6509 then to Netflow

Edison Ortiz — Wed, 08 Aug 2012 13:31:24 GMT

The physical interface where the sniffer is connected to on the 6509 side.

The source would be the RSPAN Vlan

On the 3750 side, the source is the packets being captured and the destination is the RSPAN Vlan.

Regards,

Edison