09-12-2011 06:31 AM - edited 03-07-2019 02:10 AM
Hi all,
I am having trouble directing a SPAN session through both a 2940 and 2960G switch. I have a Nexus 5K provding/outputting a SPAN session, going to to an interface on the 29xx configured as a SPAN source. I then have another interface on the 29xx configured as a SPAN destination, however no interesting traffic is egressing that interface.
More details - the 5K is sending the traffic unencapsulated (confirmd by packet capture) at about 10000 packets/sec. (~30Mb/sec) The 29xx is reporting the same traffic ingressing it's SPAN source interface (configured for both tx and rx traffic). The SPAN destination interface (no ingress traffic permitted) is reporting almost no outpout traffic (confirmed by packet capture). It seems the packets are getting "lost" in the switch between the source and destination SPAN interfaces.
When I very first apply the SPAN config, the detination interface reports approx 600 pps output, but this then goes to nearly 0 in a couple of minutes!
There are no clues in the logs, and the cpu is very low....
Any ideas greatly appreciated, please let me know if you need further info.
Cheers,
Jeremy
09-13-2011 01:31 AM
Hi Jeremy,
Could you please share the output from your 2900 Series switch.
also, wanted to know what is connected to the destination port.
Regards,
Sunil
09-13-2011 03:30 AM
Hi,
Whether the monitoring vlan is configured on all the switches?
vlan
remote span
++ The remote span vlan should be configured in all of the intermediate switches between the source and the
destination. Otherwise the traffic won't get passed.
++ You cannot use the RSPAN destination port to inject traffic from a network security device.
++ The switch does not support ingress forwarding on an RSPAN destination port.
Hope this helps
cheers
Somu
Rate helpful posts
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide