Preserving encapsulation across SPAN

By stretch | Thursday, May 1, 2008 at 2:02 a.m. UTC

The other day I was attempting to analyze traffic traversing an 802.1Q trunk via SPAN, and I noticed the trunk headers were missing. I also noticed I wasn't seeing the typical background traffic like STP and CDP. A bit of poking around suggested I needed to configure SPAN to replicate the source 802.1Q encapsulation.

Switch(config)# monitor session 1 source interface g0/1
Switch(config)# monitor session 1 destination interface g0/2 encapsulation replicate

Alternatively, the encapsulation can be explicitly configured as either 802.1q or ISL. After modifying the SPAN session I was seeing all traffic as expected. Seems strange that this isn't done by default.

About the Author

Jeremy Stretch is a freelance networking engineer, instructor, and the maintainer of PacketLife.net. He currently lives in Fairfax, Virginia, on the edge of the Washington, DC metro area. Although primarily an R&S guy, he likes to get into everything, and runs a free network training lab out of his basement for fun. You can contact him by email or follow him on Twitter.

Posted in Switching

Comments

Rodrigo (guest) commented on Thursday, May 1, 2008 at 2:56 a.m. UTC

Your blog, more specifically your cheat sheets help me on passing on BCMSN exam :)

And your blog is very interesting, you raise interesting questions.

Congratulations!

Leave a Comment


Register to comment as a member. You'll look cooler.

Optional; will not be displayed publicly or given out.

No commercial links. Only personal (e.g. blog, Twitter, or LinkedIn) and/or on-topic links, please.
What protocol is used to retrieve web pages?