Remote Switched Port Analyzer

Jul 08,2008 by admin

Unlike Local SPAN, Remote SPAN (RSPAN) allows for the SPAN destination port to be anywhere on the Layer 2 network. This can potentially help save time because the network engineer does not have to worry about placing the sniffer on the same switch as the source. In fact, multiple destination ports can be configured. A Catalyst 6500 can support up to 24 RSPAN destination ports. Sniffers can be strategically placed so that they are readily available if needed. A special VLAN is created for RSPAN to carry the copied source traffic to the destination port. The traffic in RSPAN VLAN is flooded because learning of MAC address is disabled. RSPAN VLAN does not generate bridge protocol data units (BPDUs) on the network.

A source switch is where the monitored ports are located. A source switch can only support one RSPAN VLAN. The steps outline has two switches connected back to back using Inter-Switch Link (ISL) trunking.