Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My scenario is that I have > 1g of traffic on a switch, but only a 1g monitor port. But the traffic I'm actually interested in is only about 10mbps, the rest can be ignored.

I have one 3560 switch, and I want to configure a SPAN port but also enable an IP ACL. I understand this is possible, at least on the 6500s, by configuring one session with a destination of an RSPAN VLAN, and another session (same switch) using that RSPAN VLAN as the source. Then apply an ACL to the RSPAN VLAN. This is described here: Using RSPAN with VACLs for Granular Traffic Analysis .

However, this doesn't seem to work on a 3560. I even removed the ACLs, and still no-go:

vlan 555
 remote-span
interface Vlan555
 no ip address
 shutdown
monitor session 50 source interface Fa0/24
monitor session 50 destination remote vlan 555
monitor session 51 destination interface Fa0/22
monitor session 51 source remote vlan 555

No traffic shows up. If I clear those monitor sessions and just do source fa0/24 dest fa0/22, then it works fine. (Ignore that I'm using FE here as a test.)

Any ideas? Other ways of getting an ACL into a SPAN without needing a second switch?

Update: Well according to this:

Can a RSPAN Source Session and the Destination Session Exist on the Same Catalyst Switch? No. RSPAN does not work when the RSPAN source session and the RSPAN destination session are on the same switch.

That's a limitation on 4500 and 3750, so I guess that means 3560 too. Any other workarounds?

Update 2: I'm not quite sure what RSPAN actually does on the wire. I configured RSPAN, but instead of putting it on a trunk port to another switch, I put it onto a trunk port to my NIC. Traffic is replicated, but the RSPAN VLAN's ACL is not applied, even though the 3560 config document explicitly says it should work.

share|improve this question
    
your interface for vlan555 needs to be 'no shut'. –  Tim Kennedy Apr 12 '11 at 3:05
    
Surely you won't be able to capture only the correct traffic in any case - the traffic above the 1Gb/s mark will never be seen by the ACL. You'll just see that proportion of the traffic below 1Gbp/s which matches the ACL. –  Cian Jun 16 '11 at 15:01

1 Answer 1

If I understand right, it sounds like you want to capture some traffic traversing your switch, but you want to filter that traffic before it is placed on the wire connecting to the capturing station.

I doubt you can do that with a 3560-class switch. Check this config guide. I didn't see in there any mention of VACL's within RSPAN sessions. Not that the feature couldn't possibly exist, but from what I remember, VACL's are 6500-specific and are used mainly to filter live traffic passed within any particular VLAN.

I would look at other ways of isolating the interesting traffic, unless you can RSPAN the traffic to a 6500.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.