Users Guide

Table Of Contents
572 Monitoring Switch Traffic
The reflector port must be configured as the only member of the RSPAN
VLAN on the source switch. The source interface must be configured as the
only member of the RSPAN VLAN on the destination switch. Configuring a
source that mirrors to the RSPAN VLAN on the destination switch is not
supported.
RSPAN intermediate switches may also be configured with multiple source
ports feeding into an existing RSPAN VLAN. The source configuration
requires an interface parameter so traffic mirrored on the intermediate switch
is not flooded across the entire RSPAN VLAN. Place probe ports upstream of
the intermediate switch in this case.
Configuring a second session on a source switch that mirrors RSPAN traffic
from the reflector port is not supported. Configuring a second session on a
source switch that mirrors an RSPAN source port to a local probe port is
supported.
If an ACL filter is specified, the ACL must be created prior to its use in an
RSPAN configuration. The ACL filter is configured on the source switch.
ACL filters are internally configured as an egress ACL on the destination
interface/reflector port. All the criteria in the ACL are marked with the mirror
attribute (and the RSPAN VLAN) to match the mirrored traffic (including
the implicit deny-all). If configuring an egress ACL on the destination port,
care must be taken with the ACL numbering to ensure the mirrored traffic is
properly processed.
RSPAN VLANs must be configured with the remote-span command prior to
configuration in an RSPAN session.
VLAN mirroring is not recommended for RSPAN if sources on multiple
switches are members of the VLAN. This is because, as stations communicate
with each other over the mirrored VLAN, duplicate packets will be sent to the
probe: once for the source port, and once for each switch over which the
packet is received in the source VLAN.
Remote Capture
The Remote Capture feature enables mirroring packets transmitted and
received by the switch CPU to a remote client for packet analysis using the
Wireshark tool. This feature can be used to help diagnose switch behavior or
monitor traffic sent to the switch CPU. The capture feature can also be
configured to capture to a local file or to an in-memory buffer.