Reset Search



Port mirroring with multiple ports

« Go Back


TitlePort mirroring with multiple ports
There are many times that a user may want to use the RSPAN feature to collect data that is sent back to an analyzer for further processing. This may be call data used for billing records, call RTP or any other packet data that could be analyzed with programs such as Wireshark. This can be used in production or testing of equipment.

Consider the use of capturing RTP packets of voice data or in the use of penetration testing, that traffic may want to be collected from several ports in order to validate that you have recorded all flows in a larger process.
The NOS SPAN feature supports collecting from multiple source ports and sending all data to one destination port. The following configuration is valid.
# sh run monitor
monitor session 1
source fortygigabitethernet 1/0/1 destination fortygigabitethernet 2/0/36 direction both
monitor session 2
source fortygigabitethernet 2/0/2 destination fortygigabitethernet 2/0/36 direction both
monitor session 3
source fortygigabitethernet 3/0/3 destination fortygigabitethernet 2/0/36 direction both

In this configuration you will see that the source ports can be on any Rbridge in the fabric while all destination ports are configured to the same interface.

NOTE: If the destination port becomes over run it will generate back pressure on all of the source ports which will then start discarding source RX frames.
Additional notes



Was this article helpful?



Please tell us how we can make this article more useful.

Characters Remaining: 255