Hi Folks. I recently tried some stuff with SPAN and RSPAN on some Catalyst 3750 in a lab, and saw this behavior:
I was running one local SPAN and one remote SPAN session on the same switch with just one uplink.
The RSPAN was mirroring traffic from an Access Port where a PC was connected. The local session was mirroring on the uplink port.
My Laptop was connected to the port configured as the local SPAN destination and running Wireshark.
When the PC was issuing Pings to devices connected on other switches (going over the uplink), my expectation was to see every single Ping twice. Because the local session was mirroring the uplink (trunk) and I thought I'll see the traffic for the ping AND the traffic for the RSPAN session..
But i only saw the pings once.. no traffic from the RSPAN session was captured.
Pings and RSPAN session were working though.. I also saw the pings on the machine behind the RSPAN session.
Why didn't the local session capture the remote SPAN traffic??
No comments:
Post a Comment