cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
621
Views
0
Helpful
1
Replies

RSPAN, only broadcast/multicast in destination

kiribool
Level 1
Level 1

Hi,

I have RSPAN configuration, but I see only broadcast/multicast traffic.

I have this:

PC (vlan 100) - SW1 -(trunk)- SW2 -(trunk)- SW3 -(trunk)- SW4 - (gi0/23) tcpdump

SW1 - 2960 - c2960-lanbasek9-mz.122-50.SE5

SW2 - 2960

SW3 - 3750X

SW4 - 2960

All switches are VTP domain members. VTP pruning mode is enabled.

VLAN 997 is remote span vlan.

The command "sh vlan remote-span" on all switces output is below:

Remote SPAN VLANs
------------------------------------------------------------------------------
997

Config SW1:

monitor session 1 source vlan 100

monitor session 1 destination remote vlan 997

Config SW4:

monitor session 1 destination interface Gi0/23
monitor session 1 source remote vlan 997

sh run int gi0/23

interface GigabitEthernet0/23
 switchport mode access
end

Linux endpoint have a eth1 interface in promisc mode:

netstat -i

eth1 BMPRU

Where I can be wrong in the configuration?

Thanks.

1 Reply 1

Elohim
Level 1
Level 1

Have you tried setting Gi 0/23 to a trunk port instead?

Review Cisco Networking for a $25 gift card