cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Bookmark
|
Subscribe
|
216
Views
0
Helpful
0
Replies

RSPAN question

jedavis
Level 4
Level 4

I had a situation where I was getting a high rate of traffic coming into G1/0/12 on a 2960-X from an unmanaged switch.  This was getting flooded out to every other port on that switch that was in the same VLAN.  Here is a snippet of what I was seeing

Switch#sho int | i GigabitE|put rate

.....

GigabitEthernet1/0/10 is up, line protocol is up (connected)
5 minute input rate 17000 bits/sec, 14 packets/sec
5 minute output rate 2467000 bits/sec, 3389 packets/sec
GigabitEthernet1/0/11 is down, line protocol is down (notconnect)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
GigabitEthernet1/0/12 is up, line protocol is up (connected)
30 second input rate 2459000 bits/sec, 3398 packets/sec
30 second output rate 17000 bits/sec, 21 packets/sec
GigabitEthernet1/0/13 is up, line protocol is up (connected)
5 minute input rate 26000 bits/sec, 26 packets/sec
5 minute output rate 2766000 bits/sec, 3414 packets/sec
GigabitEthernet1/0/14 is up, line protocol is up (connected)
5 minute input rate 158000 bits/sec, 131 packets/sec
5 minute output rate 2638000 bits/sec, 3512 packets/sec
GigabitEthernet1/0/15 is up, line protocol is up (connected)
5 minute input rate 170000 bits/sec, 20 packets/sec
5 minute output rate 2438000 bits/sec, 3386 packets/sec

...

As you can see port 12 has a packet input rate of > 3000 pps and all of the other ports have an output rate of > 3000 pps.  Ok, so I am going to set up an RSPAN session on one of the ports that has a high output rate so I can see what that traffic is.  I already have RSPAN vlan 241 configured. 

Switch#monitor session 1 source interface g0/13

Switch#monitor session 1 dest rem vlan 241

Switch#show mon sess 1 detail

Switch#sho mon sess 1 detail
Session 1
---------
Type : Remote Source Session
Description : -
Source Ports :
RX Only : None
TX Only : None
Both : Gi1/0/13
Source VLANs :
RX Only : None
TX Only : None
Both : None
Source RSPAN VLAN : None
Destination Ports : None
Filter VLANs : None
Dest RSPAN VLAN : 241

I capture traffic going to/from the device on port 13 but this captures none of the offending multicast traffic.  I see only a few packets per second, nothing near the 3000+ that the switch reports.  I also tried capturing only TX packets but that didn't get it either.  In the end I moved to the switch that was immediately upstream from this one and did the RSPAN session on the trunk port connected to this switch.  Only then did I capture the multicast traffic that the switch reports.

So why does my RSPAN session not capture this egress multicast traffic?

TIA - Jeff

0 Replies 0