RSPAN question
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-01-2017 07:56 AM - edited 03-08-2019 10:49 AM
I had a situation where I was getting a high rate of traffic coming into G1/0/12 on a 2960-X from an unmanaged switch. This was getting flooded out to every other port on that switch that was in the same VLAN. Here is a snippet of what I was seeing
Switch#sho int | i GigabitE|put rate
.....
GigabitEthernet1/0/10 is up, line protocol is up (connected)
5 minute input rate 17000 bits/sec, 14 packets/sec
5 minute output rate 2467000 bits/sec, 3389 packets/sec
GigabitEthernet1/0/11 is down, line protocol is down (notconnect)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
GigabitEthernet1/0/12 is up, line protocol is up (connected)
30 second input rate 2459000 bits/sec, 3398 packets/sec
30 second output rate 17000 bits/sec, 21 packets/sec
GigabitEthernet1/0/13 is up, line protocol is up (connected)
5 minute input rate 26000 bits/sec, 26 packets/sec
5 minute output rate 2766000 bits/sec, 3414 packets/sec
GigabitEthernet1/0/14 is up, line protocol is up (connected)
5 minute input rate 158000 bits/sec, 131 packets/sec
5 minute output rate 2638000 bits/sec, 3512 packets/sec
GigabitEthernet1/0/15 is up, line protocol is up (connected)
5 minute input rate 170000 bits/sec, 20 packets/sec
5 minute output rate 2438000 bits/sec, 3386 packets/sec
...
As you can see port 12 has a packet input rate of > 3000 pps and all of the other ports have an output rate of > 3000 pps. Ok, so I am going to set up an RSPAN session on one of the ports that has a high output rate so I can see what that traffic is. I already have RSPAN vlan 241 configured.
Switch#monitor session 1 source interface g0/13
Switch#monitor session 1 dest rem vlan 241
Switch#show mon sess 1 detail
Switch#sho mon sess 1 detail
Session 1
---------
Type : Remote Source Session
Description : -
Source Ports :
RX Only : None
TX Only : None
Both : Gi1/0/13
Source VLANs :
RX Only : None
TX Only : None
Both : None
Source RSPAN VLAN : None
Destination Ports : None
Filter VLANs : None
Dest RSPAN VLAN : 241
I capture traffic going to/from the device on port 13 but this captures none of the offending multicast traffic. I see only a few packets per second, nothing near the 3000+ that the switch reports. I also tried capturing only TX packets but that didn't get it either. In the end I moved to the switch that was immediately upstream from this one and did the RSPAN session on the trunk port connected to this switch. Only then did I capture the multicast traffic that the switch reports.
So why does my RSPAN session not capture this egress multicast traffic?
TIA - Jeff
- Labels:
-
Other Switching
