SPAN RELATED

[Himanshu_Dwivedi]

Hello Team,

I am having confusion on Span port. Please consider below topology in which there is 1 L3 Core Switch and 3 Access Switches and I have configured SPAN session on core switch and connected system to G1/0/1 with wireshark will that system get the traffic from source vlan.

Monitor Session 1 source vlan 1723

Monitor session 1 destination G1/0/1

Note : System 1,2,3 are communicating to each other within same access switch but not with 4,5,6 and 7,8,9, same is the communication for rest of the PC's. Will I get the traffic on core switch and will see on wireshark or it is limited to Access switch only. Or I will have to setup the RSPAN.

[pieterh · Accepted solution]

packets are forwarded based on MAC address
as such , unicast packets from 1 to 2 (vica versa) will not be forwarded through the uplink to the L3 switch
only packets like broadcast (e.g. ARP requests) will reach the L3 switch and will be forwarded to Wireshark
-> you need RSPAN here