08-07-2016 01:50 AM - edited 03-08-2019 06:54 AM
I've got 4 switches in a medium sized office network. I have a local SPAN port set up on each switch which gets a copy of traffic from all other ports local to their respective switches. The destination SPAN port on each of the switches is connected to a fifth switch. On this fifth switch, I've again got the four ports to which the other four switches are connected to set as SPAN source ports, while a single port has been set as a SPAN destination port. When I try connecting a PC to the SPAN destination, I don't receive as much traffic as I'd expect to see. Is it even possible to work with a setup like this? Or is RSPAN the only possible way to carry this out?
I've also attached an image showing the basic setup if it helps.
08-07-2016 07:05 PM
Interesting setup, I doubt a lot of people will have experience with it. I guess theoretically this could work.
I guess you will need to test it, by looking at your wireshark and see if you can pick up traffic from specific ports of each of your access switches. so if you connect to your fifth switch and see if you capture anything from a device on the first switch (use an ip host filter in wireshark), go filter wireshark for a client on your second switch etc etc.
08-08-2016 01:07 PM
It does seem to be working, but I don't think I'm getting as much traffic as I should be. I'll only be able to tell once I carry out a few tests using Wireshark.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide