cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
336
Views
0
Helpful
2
Replies

Monitoring SPAN traffic from more than one switch without using RSPAN

savio00011
Level 1
Level 1

I've got 4 switches in a medium sized office network. I have a local SPAN port set up on each switch which gets a copy of traffic from all other ports local to their respective switches. The destination SPAN port on each of the switches is connected to a fifth switch. On this fifth switch, I've again got the four ports to which the other four switches are connected to set as SPAN source ports, while a single port has been set as a SPAN destination port. When I try connecting a PC to the SPAN destination, I don't receive as much traffic as I'd expect to see. Is it even possible to work with a setup like this? Or is RSPAN the only possible way to carry this out?

I've also attached an image showing the basic setup if it helps.

2 Replies 2

Dennis Mink
VIP Alumni
VIP Alumni

Interesting setup, I doubt a lot of people will have experience with it. I guess theoretically this could work.

I guess you will need to test it, by looking at your wireshark and see if you can pick up traffic from specific ports of each of your access switches. so if you connect to your fifth switch and see if you capture anything from a device on the first switch (use an ip host filter in wireshark), go filter wireshark for a client on your second switch etc etc. 

Please remember to rate useful posts, by clicking on the stars below.

It does seem to be working, but I don't think I'm getting as much traffic as I should be. I'll only be able to tell once I carry out a few tests using Wireshark.

Review Cisco Networking for a $25 gift card