Preserving encapsulation across SPAN
By stretch | Thursday, May 1, 2008 at 2:02 a.m. UTC
The other day I was attempting to analyze traffic traversing an 802.1Q trunk via SPAN, and I noticed the trunk headers were missing. I also noticed I wasn't seeing the typical background traffic like STP and CDP. A bit of poking around suggested I needed to configure SPAN to replicate the source 802.1Q encapsulation.
Switch(config)# monitor session 1 source interface g0/1 Switch(config)# monitor session 1 destination interface g0/2 encapsulation replicate
Alternatively, the encapsulation can be explicitly configured as either 802.1q or ISL. After modifying the SPAN session I was seeing all traffic as expected. Seems strange that this isn't done by default.
About the Author
Jeremy Stretch is a network engineer living in the Raleigh-Durham, North Carolina area. He is known for his blog and cheat sheets here at Packet Life. You can reach him by email or follow him on Twitter.
Posted in Switching
May 1, 2008 at 2:56 a.m. UTC
Your blog, more specifically your cheat sheets help me on passing on BCMSN exam :)
And your blog is very interesting, you raise interesting questions.