SPAN or RSPAN

[shanyee75]

Hi,

I need to setup port mirroring on Catalyst 4006 switch. Both source and destination port is on the same switch.

I need to capture all traffics across the LAN for analysis. Is it enough by configuring SPAN? Please advise.

[ankurbhasin]

Hi Friend,

If your both source and destination port are on a same switch you are good to go with SPAN.

Have a look at this link to configure SPAN on cat4k switch

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/rel7_1/config/span.htm

But as you also said you want to capture traffic acorss the lan in this case the source port may exist on different switches and incase your source port and destination port exist on different switch then you surely need a RSPAN.

Also instead of configuring a specific source port to capture you can capture complete vlan when you configure SPAN you can also configure source vlan to capture all traffic on and for that vlan.

HTH, if yes please rate the post.

Ankur

[shanyee75]

Hi,

Thanks. If I want to capture traffic from VLAN 2, 3 and 4 across the LAN, is it enough by just configuring SPAN?

E.g. Console> (enable) set span 2,3,4 2/1

Will the traffic from other switches being captured?

[ankurbhasin]

Hi Friend,

No you have to confiure RSPAN for that purpose. If you just want to capture vlan traffic for vlan 2,3,4 on a particular switch and destination is also on the same switch you can use SPAN.

But if you want to capture vlan traffic for vlan 2,3,4 across the lan on multiple switches you have to use RSPAN.

HTH, if yes please rate the post.

Ankur