Preserving encapsulation across SPAN

By stretch | Thursday, May 1, 2008 at 2:02 a.m. UTC

The other day I was attempting to analyze traffic traversing an 802.1Q trunk via SPAN, and I noticed the trunk headers were missing. I also noticed I wasn't seeing the typical background traffic like STP and CDP. A bit of poking around suggested I needed to configure SPAN to replicate the source 802.1Q encapsulation.

Switch(config)# monitor session 1 source interface g0/1
Switch(config)# monitor session 1 destination interface g0/2 encapsulation replicate

Alternatively, the encapsulation can be explicitly configured as either 802.1q or ISL. After modifying the SPAN session I was seeing all traffic as expected. Seems strange that this isn't done by default.

About the Author

Jeremy Stretch is a network engineer living in the Raleigh-Durham, North Carolina area. He is known for his blog and cheat sheets here at Packet Life. You can reach him by email or follow him on Twitter.

Posted in Switching


Rodrigo (guest)
May 1, 2008 at 2:56 a.m. UTC

Your blog, more specifically your cheat sheets help me on passing on BCMSN exam :)

And your blog is very interesting, you raise interesting questions.


Comments have closed for this article due to its age.