Passing VLAN tags across a Cisco Span Session

[giwiwuz5]

It would appear as if a typical SPAN port does not pass the VLAN tags across that SPAN? Specifically I have a 3550 that I created a span for. The source port is the uplink fiber to the switch which is a trunk port. The only problem is that I can't seem to get any VLAN information with an analyzer that I know supports VLAN tagging. Does anyone have any experience with how to get my VLAN tags across my span session?

Regards,
Desperate

 

[ADB100]

When you specify the destination you can also specify whether VLAN Tags are sent as well:

monitor session 1 destination interface fastEthernet 0/15 encapsulation dot1q

HTH

Andy

 

[BuckWeet]

I don't believe 3550's will support this feature..

only in higher end switches can you span a trunk port. lower end switches you can only span a single vlan of a trunk port at a time.

i think the minimum to do this is a 4500..


BuckWeet

 

[ADB100]

BuckWeet - I think you are wrong there, I just tested this and it does indeed work. I have a 3550 running 12.2(25)SEC IP Services image with a Gig Trunk uplink to a 2950:

monitor session 1 source interface Gig 0/1 both
monitor session 2 destination interface fast 0/15 encapsulation dot1q

I have a laptop with Ethereal running and a 3Com Cardbus FastEthernet card and I can see all the tagged traffic on the uplink.

Andy

 

[giwiwuz5]

Wow, it worked, thanks ABD100. This only applies to IOS which I do have in this case but I do support CatOS as well do you know the right commands for accomplishing the same thing with the "Set Span" commands? Thanks again for the great info!

 

[BuckWeet]

Cool!

maybe its a 3524 that i tried this on and it didn't.. or maybe they added that feature in the new code..


but iknow it didn't use to work, lol!!


Thanks for the update

BuckWeet

 

[ADB100]

Sorry I don't have a CatOS switch to hand but my gut feeling is it will work by default if you span a trunk port:

set span 1/1 3/10 both

The documentation says:

If the trunking mode of a SPAN destination port is "on" or "nonegotiate" during the SPAN session configuration, the SPAN packets that are forwarded by the destination port have the encapsulation as specified by the trunk type; however, the destination port stops trunking, and the show trunk command reflects the trunking status for the port prior to the SPAN session configuration.


HTH

Andy