Switch generated packets in SPAN session

gnijs · ‎06-20-2011

Hello,

Does anyone know if i can see switch generated packets in a SPAN session on a C3750 switch ?

For example: i want to see the ports generated BPDUs (by the switch) and also the switch generated LOOP packets ,

however i have noticed i don't see any BPDU packets in my captures, while the BPDU do increment in the "show spanning tree details" command.

Soft version: 12.2(46)SE4

regards,

Geert

smogra · ‎06-20-2011

Hi,

You need to use the SPAN and define the destination port using the optional encapsulation replicate keywords.

The default configuration for local SPAN session ports is to send all packets untagged. SPAN also does not normally monitor bridge protocol data unit (BPDU) packets and Layer 2 protocols, such as Cisco Discovery Protocol (CDP), VLAN Trunk Protocol (VTP), Dynamic Trunking Protocol (DTP), Spanning Tree Protocol (STP), and Port Aggregation Protocol (PAgP). However, when you enter the encapsulation replicate keywords when configuring a destination port, these changes occur:

Packets are sent on the destination port with the same encapsulation—untagged, Inter-Switch Link (ISL), or IEEE 802.1Q—that they had on the source port.
Packets of all types, including BPDU and Layer 2 protocol packets, are monitored.

Therefore, a local SPAN session with encapsulation replicate enabled can have a mixture of untagged, ISL, and IEEE 802.1Q tagged packets appear on the destination port.

See http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_55_se/configuration/guide/swspan.html#wp1204187 for further info.

Regards

Sweta