Solved

how to capture vlan traffic accross multiple cisco switch stacks

Posted on 2013-12-06
2
739 Views
Last Modified: 2013-12-11
I have a need to span traffic for a particular vlan to a single port on one of my core switches for packet capture purposes.
Currently this vlan traffic propagates throughout the network via trunk connections from the core switch to several cisco switch stacks.  So my question is if I setup a monitor session to capture this specific vlan as a source on the core switch, is it going to be enough to capture all the vlan traffic on the network.   Or, do I need to enable some type of RSPAN?  

thank you.
0
Comment
Question by:FREDARCE
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 42

Expert Comment

by:kevinhsieh
ID: 39702796
Are you trying to capture traffic on all ports within the VLAN, or all traffic that crosses the VLAN interface? When you monitor a VLAN interface, you only see the traffic that hits that L3 interface. It's really easy to monitor that L3 interface from the same switch that has the L3 interface. If you also want to capture traffic that stays on the VLAN, you are probably looking at RSPAN, which is something I don't have any experience with.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 500 total points
ID: 39702959
No, the switches only route traffic to other switches when they need to. You'd want a span session on each switch, with the vlan's configured in each span session. You can FWD those spans to the core switch, but make sure you add new trunks if the existing ones will be saturated. Look for RSPAN on cisco's site: (as mentioned above)
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_55_se/configuration/guide/swspan.html#wp1317252
-rich
0

Featured Post

Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Communicating machines through cross-over cable? 5 95
IP Jumping 6 72
Wannacry 44 101
Forwarding with Microsoft DNS 11 40
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
Arrow Electronics was searching for a KVM  (Keyboard/Video/Mouse) switch that could display on one single monitor the current status of all units being tested on the rack.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question