07-23-2010 01:29 AM - edited 03-06-2019 12:09 PM
If I monitor a port with SPAN on a 6500 and the device is sending in traffic marked with DSCP values but the port is not configured to trust dscp or cos (mls qos is on globally) will I see the packets before they are rewritten with the dscp value the device is sending in or after they have been rewritten with a dscp value of 0?
Thanks in advance
Solved! Go to Solution.
07-23-2010 02:38 AM
You are welcome Nick.
The information comes from "CCIE R&S 4th Edition - Chapter 1" (http://www.ciscopress.com/bookstore/product.asp?isbn=1587059800)
We can also find the information at this non-cisco link : http://www.proprofs.com/flashcards/tableview.php?title=span-rspan
But I suppose the same information is given diffently on this Cisco link :
For example : A SPAN destination port that is copying traffic from a single egress SPAN source port sends only egress traffic to the network analyzer
(meaning after treatment of the packet).
Hope it helps.
Karim
07-23-2010 01:40 AM
Hello n.oneill,
From the documentation :
SPAN and RSPAN support two types of traffic: transmitted and received. By default, SPAN is
enabled for traffic both entering and exiting the source port or VLAN. However, SPAN can be
configured to monitor just transmitted traffic or just received traffic. Some additional conditions
apply to these traffic types, as detailed in this list:
■ For Receive (RX) SPAN, the goal is to deliver all traffic received to the SPAN destination. As
a result, each frame to be transported across a SPAN connection is copied and sent before any
modification (for example, VACL or ACL filtering, QoS modification, or even ingress or
egress policing).
■ For Transmit (TX) SPAN, all relevant filtering or modification by ACLs, VACLs, QoS, or
policing actions are taken before the switch forwards the traffic to the SPAN/RSPAN
destination. As a result, not all transmit traffic necessarily makes it to a SPAN destination.
Also, the frames that are delivered do not necessarily match the original frames exactly,
depending on policies applied before they are forwarded to the SPAN destination.
Thanks
Karim
07-23-2010 02:13 AM
Thanks Karim
Could you please link the documentation you are refrerring to?
Regards
Nick
07-23-2010 02:23 AM
Thanks Karim
Could you please link the documentation you are refrerring to?
Regards
Nick
Hi Nick,
Check out the below link for span and rspan guidelines with explanation on each in cisco 6500 switches
Hope to Help !!
Ganesh.H
07-23-2010 02:38 AM
You are welcome Nick.
The information comes from "CCIE R&S 4th Edition - Chapter 1" (http://www.ciscopress.com/bookstore/product.asp?isbn=1587059800)
We can also find the information at this non-cisco link : http://www.proprofs.com/flashcards/tableview.php?title=span-rspan
But I suppose the same information is given diffently on this Cisco link :
For example : A SPAN destination port that is copying traffic from a single egress SPAN source port sends only egress traffic to the network analyzer
(meaning after treatment of the packet).
Hope it helps.
Karim
07-23-2010 02:41 AM
Again, many thanks.
I shall be ordering that book
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide