Switches

How to monitor network traffic through Cisco RSPAN capable switches

Leveraging RSPAN can be helpful in getting monitor traffic from switch to switch or getting monitor traffic into a hypervisor such as VMware or HyperV

Configure Catalyst IOS Switch

  1. Open a session on the switch
  2. Enter configure mode configure terminal
  3. Set the destination RSPAN VLAN. This should be an unused VLAN. We will use VLAN 400 in the example.
    vlan <RSPAN VLAN HERE>
    remote-span
    end
    

    Example:

    vlan 400
    remote-span
    end
    
  4. Configure the destination port to send the data to
    monitor session 1 source interface <source interface>
    monitor session 1 source vlan <source VLAN>
    

    Example:

    monitor session 1 source interface gigabitethernet5/1
    monitor session 1 source vlan 1
    monitor session 1 source vlan 100
    
  5. Configure the destination port to send the data to
    monitor session <session> destination interface <interface>
    

    Example:

    monitor session 1 destination remote vlan 400
    end
    
  6. Exit back to configuration mode
    exit
    

Ensure you save your configuration once you have verified it is configured correctly.

You can reference our VMware or HyperV virtual switch configuration guides to now monitor the VLAN traffic as it is passed to the hypervisor host.