Switches

How to monitor network traffic through Cisco RSPAN capable switches

Leveraging RSPAN can be helpful in getting monitor traffic from switch to switch or getting monitor traffic into a hypervisor such as VMware or HyperV

Configure Catalyst IOS Switch

  1. Open a session on the switch
  2. Enter configure mode
    configure terminal

  3. Set the destination RSPAN VLAN. This should be an unused VLAN. We will use VLAN 400 in the example.

vlan <RSPAN VLAN HERE>
remote-span
end

Example:

vlan 400
remote-span
end

  1. Configure the destination port to send the data to

monitor session 1 source interface <source interface>
monitor session 1 source vlan <source VLAN>

Example:

monitor session 1 source interface gigabitethernet5/1
monitor session 1 source vlan 1
monitor session 1 source vlan 100

  1. Configure the destination port to send the data to

monitor session <session> destination interface <interface>

Example:
monitor session 1 destination remote vlan 400
end

  1. Exit back to configuration mode

exit

Ensure you save your configuration once you have verified it is configured correctly.

You can reference our VMware or HyperV virtual switch configuration guides to now monitor the VLAN traffic as it is passed to the hypervisor host.