Preserving encapsulation across SPAN

By stretch | Thursday, May 1, 2008 at 2:02 a.m. UTC

The other day I was attempting to analyze traffic traversing an 802.1Q trunk via SPAN, and I noticed the trunk headers were missing. I also noticed I wasn't seeing the typical background traffic like STP and CDP. A bit of poking around suggested I needed to configure SPAN to replicate the source 802.1Q encapsulation.

Switch(config)# monitor session 1 source interface g0/1
Switch(config)# monitor session 1 destination interface g0/2 encapsulation replicate

Alternatively, the encapsulation can be explicitly configured as either 802.1q or ISL. After modifying the SPAN session I was seeing all traffic as expected. Seems strange that this isn't done by default.

Posted in Switching

Comments


Rodrigo
May 1, 2008 at 2:56 a.m. UTC

Your blog, more specifically your cheat sheets help me on passing on BCMSN exam :)

And your blog is very interesting, you raise interesting questions.

Congratulations!

Comments have closed for this article due to its age.