Preserving encapsulation across SPAN

By stretch | Thursday, May 1, 2008 at 2:02 a.m. UTC

The other day I was attempting to analyze traffic traversing an 802.1Q trunk via SPAN, and I noticed the trunk headers were missing. I also noticed I wasn't seeing the typical background traffic like STP and CDP. A bit of poking around suggested I needed to configure SPAN to replicate the source 802.1Q encapsulation.

Switch(config)# monitor session 1 source interface g0/1
Switch(config)# monitor session 1 destination interface g0/2 encapsulation replicate

Alternatively, the encapsulation can be explicitly configured as either 802.1q or ISL. After modifying the SPAN session I was seeing all traffic as expected. Seems strange that this isn't done by default.

About the Author

Jeremy Stretch is a networking engineer and the maintainer of PacketLife.net. He currently lives in the Raleigh-Durham area of North Carolina. Although employed full-time out of necessity, his true passion lies in improving the field of network engineering around the world. You can contact him by email or follow him on Twitter.

Posted in Switching

Comments

Rodrigo (guest) commented on Thursday, May 1, 2008 at 2:56 a.m. UTC

Your blog, more specifically your cheat sheets help me on passing on BCMSN exam :)

And your blog is very interesting, you raise interesting questions.

Congratulations!

Leave a Comment


Register to comment as a member. You'll look cooler.

Optional; will not be displayed publicly or given out.

No commercial links. Only personal (e.g. blog, Twitter, or LinkedIn) and/or on-topic links, please.
_____ is a base-16 numbering system.