Use RSPAN to mirror traffic from remote switches

Steven_zhangCreated at:Dec 11, 2019 14:05:40Updated at:Dec 11, 2019 14:06:17

The example on ECS2100 Series.

 

Introduction:

Remote Switched Port Analyzer (RSPAN) allows you to mirror traffic from remote switches for analysis on a local destination port.

In the following example, you can use PC1 to capture packets between PC2 and switch C port #4.

 

Topology:

mceclip0.png

 

Configuration:

Switch A

1. Configure A RSPAN VLAN (here is VLAN 2 since VLAN 1 cannot be the RSPAN VLAN)

A#configure
A(config)#vlan database
A(config-vlan)#vlan 2 media ethernet rspan

2. Configure the destination port (here is #1) for session 1

A(config)#rspan session 1 destination interface ethernet 1/1

3. Configure the switch role & uplink port

A(config)#rspan session 1 remote vlan 2 destination uplink ethernet 1/2

4. Check by show RSPAN

A#show rspan session 1

mceclip1.png

 

Switch B

1. Configure A RSPAN VLAN

B(config)#vlan database
B(config-vlan)#vlan 2 media ethernet rspan

2. Configure the switch role & uplink port

B(config)#rspan session 1 remote vlan 2 intermediate uplink ethernet 1/2
B(config)#rspan session 1 remote vlan 2 intermediate uplink ethernet 1/3

3. Check by show RSPAN

mceclip2.png

 

Switch C

1. Configure A RSPAN VLAN

C(config)#vlan database
C(config-vlan)#vlan 2 media ethernet rspan

2. Configure the destination port (here is #4) for session 1

C(config)#rspan session 1 source interface ethernet 1/4

3. Configure the switch role & uplink port

C(config)#rspan session 1 remote vlan 2 source uplink ethernet 1/3

4. Check by show RSPAN

mceclip3.png

 

PC 2 ping switch C, and PC1 will receive packets

mceclip4.png