cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
575
Views
0
Helpful
1
Replies

RSPAN, only broadcast/multicast in destination

kiribool
Level 1
Level 1

Hi,

I have RSPAN configuration, but I see only broadcast/multicast traffic.

I have this:

PC (vlan 100) - SW1 -(trunk)- SW2 -(trunk)- SW3 -(trunk)- SW4 - (gi0/23) tcpdump

SW1 - 2960 - c2960-lanbasek9-mz.122-50.SE5

SW2 - 2960

SW3 - 3750X

SW4 - 2960

All switches are VTP domain members. VTP pruning mode is enabled.

VLAN 997 is remote span vlan.

The command "sh vlan remote-span" on all switces output is below:

Remote SPAN VLANs
------------------------------------------------------------------------------
997

Config SW1:

monitor session 1 source vlan 100

monitor session 1 destination remote vlan 997

Config SW4:

monitor session 1 destination interface Gi0/23
monitor session 1 source remote vlan 997

sh run int gi0/23

interface GigabitEthernet0/23
 switchport mode access
end

Linux endpoint have a eth1 interface in promisc mode:

netstat -i

eth1 BMPRU

Where I can be wrong in the configuration?

Thanks.

1 Reply 1

Elohim
Level 1
Level 1

Have you tried setting Gi 0/23 to a trunk port instead?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: