RSPANs on Cisco Switches

We discussed SPANs earlier, but let’s talk about RSPANs for a bit.

Can anyone guess what the “R” means?  You guessed it — “Remote”.  An RSPAN is a way to get traffic from a SPAN source on one switch to a SPAN destination on another switch that’s connected via a trunk.

The basic premise is that a special VLAN is created on all the switches and allowed to traverse the trunks.  You then set up a SPAN session that copies your traffic to this special VLAN.  This VLAN then gets the traffic to the other switches through some voodoo magic to be used as source for a SPAN on another switch.

Let’s work through the steps.  In our example, we want to copy traffic from G2/18 on SwitchA to G3/38 on SwitchB.

First, on both switches, we need to create the new RSPAN VLAN.  We’ll assume you’ve already got it set up to allow this VLAN over your trunks.

Notice the nice keyword remote-span.  This designates the VLAN to be used in an RSPAN.  Easy so far.

Now, let’s create the session to copy traffic to the RSPAN.  The source port is G2/18, and the destination is the RSPAN VLAN.

Now the traffic is being copied to the RSPAN, so let’s copy that traffic from the RSPAN to the sniffer.  In this case, the source is the RSPAN, and the destination is the sniffer’s port.  Let’s use session 8 to avoid confusion.

There are always things to look out for, aren’t there?  The first that comes to mind is the fact that you’re copying traffic from a port onto one or more trunks.  If the port is sending enough traffic and your trunk is close to capacity, you may wind up crushing the trunk link.  That would suck.

If you have a fully-meshed switch environment, you’ll see the additional traffic across all your trunks if you’re set up that way.  If you have four trunks that transport all VLANs, you may have four copies of the data coming out of the switch.  Let’s say the box being monitored is compromised and sending out 600Mbps of data.  That means that every switch will have to deal with that much traffic.  This sounds to me like a CPU/memory issue waiting to happen.

Don’t expect RSPANs to work on your 2950 like this.  On the lower-end switches, you have to use a reflector port to copy the traffic to the RSPAN.  I don’t get into that here, but Google is your friend.

Send any Cadbury Creme Eggs questions my way.

Aaron Conaway

I shake my head around sometimes and see what falls out. That's what lands on these pages. If you have any questions, the best way to contact me is through Twitter at @aconaway.

More Posts

Follow Me:

3 comments for “RSPANs on Cisco Switches

  1. Chris Lawrence
    October 17, 2011 at 9:35 am

    Nice job…

  2. Fethi ORF
    February 28, 2012 at 5:30 pm

    Can we have at the same time on the destination switch the remote VLAN AND another local Interface both as sources within the same session. I guess NO but I need confirmation.

Leave a Reply

Your email address will not be published. Required fields are marked *