L3 Span

[chrisayres]

Simple question. Is it possible to SPAN over L3.

[bjw]

SPAN related to an interface of port, and all the traffic that passes it.

The Switched Port Analyzer (SPAN) enables you to mirror traffic on any port for analysis by a sniffer or RMON probe. The SPAN directs traffic from a GigEthernet Ethernet or Fast Ethernet port or VLAN to an GigEthernet Ethernet or Fast Ethernet monitor port for detailed analysis and troubleshooting.

You can monitor a single port or VLAN using a sniffer or remote monitoring (RMON) probe like the a Cisco SwitchProbe.

An RMON probe analysis of the remaining five RMON groups.

The closest you might get to specific L3 information would be to span a VLAN that might pass traffic over the L3 subnet that you are looking for.

http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/rmon.htm

[chrisayres]

This deosn't really answer the question I am asking.

I want to monitor a port or VLAN on a switch and set the destination port as a port on another switch that is not part of the same L2 network (so I can't use RSPAN).

[bjw]

I think you can use RSPAN, it uses an RSPAN VLAN that brings a source port on a switch to a destination port on a 2nd switch and the source vlan is configurable in RSPAN.

Theoretically it trunks the SPAN session to wherever you need it using a dedicated RSPAN VLAN. But note that RSPAN doesn't support L2 stuff like CDP, DTP, etc. I always recommend spanning locally when possible.

Check out the RSPAN configs:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a0080441ff6.html