how to capture vlan traffic accross multiple cisco switch stacks

I have a need to span traffic for a particular vlan to a single port on one of my core switches for packet capture purposes.
Currently this vlan traffic propagates throughout the network via trunk connections from the core switch to several cisco switch stacks.  So my question is if I setup a monitor session to capture this specific vlan as a source on the core switch, is it going to be enough to capture all the vlan traffic on the network.   Or, do I need to enable some type of RSPAN?  

thank you.
FREDARCEAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
Rich RumbleConnect With a Mentor Security SamuraiCommented:
No, the switches only route traffic to other switches when they need to. You'd want a span session on each switch, with the vlan's configured in each span session. You can FWD those spans to the core switch, but make sure you add new trunks if the existing ones will be saturated. Look for RSPAN on cisco's site: (as mentioned above)
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_55_se/configuration/guide/swspan.html#wp1317252
-rich
0
 
kevinhsiehCommented:
Are you trying to capture traffic on all ports within the VLAN, or all traffic that crosses the VLAN interface? When you monitor a VLAN interface, you only see the traffic that hits that L3 interface. It's really easy to monitor that L3 interface from the same switch that has the L3 interface. If you also want to capture traffic that stays on the VLAN, you are probably looking at RSPAN, which is something I don't have any experience with.
0
All Courses

From novice to tech pro — start learning today.