vlan tag preservation span monitoring

[BalajiDasarathan]

Hi

I am spanning multiple vlans as source with the destination as a single ethernet port, though I am able to see the traffic from the VLANs, I am not able to see the VLAN tag in the packet which is a key requirement for me for monitoring.

Does anyone know why the VLAN tagging is stripped or how to preserve it in the monitor session?

Your help is much appreciated.

- Balaji

[kcnajaf]

Hi Balaji,

As far as I know VLAN tag happens only on the trunk links in order to identify which vlan each packets belongs to. If you are trying to monitor the SVI's I would assume you will not be able to see the VLAN tag in-formations on it. Try monitoring the trunk port and you should be able to see the VLAN tag information.

Hope that helps.

Regards

Najaf

[BalajiDasarathan]

While I appreciate your response Najaf, we have been monitoring the SVIs on our current CAT6500 switches without any problems as we can "preserve" the vlan tags on the destination monitoring port.

However, we have found a way to see the VLAN tags on the monitoring destination port but we are still carrying out some tests to confirm our findings.

Will keep this thread updated.

-Balaji

[BalajiDasarathan]

Hello

We did find a solution to this, in order to see the vlan tags on the monitoring port, we need to configure the destination port as a trunk port and include a command "ethertype 0x9100" for it to work.

Following is the configuration;

switchport mode trunk

  switchport monitor

  switchport dot1q ethertype 0x9100