[c-nsp] SPAN (forwarding mirrored traffic)

[Carl Neenan]

Hi

I need to capture upstream/downstream traffic at the demarcation point
with one of our suppliers.

Our sniffer is in a different location to the demarcation point so I
need to switch the mirrorred traffic.

Below shows the set-up -


Cisco               Juniper ERX     Juniper M-Series
3550  Port0/0<--------->1440<------------>M10i<------>Transit
         +
Mirrored +
Traffic  +             
         +             Foundry            Foundry
3550  Port0/5<-------->BigIron<---------->BigIron<-------->sniffer
                                 dot1q


span configured on Cisco 3550 (destination port is 0/5) for both
in/out traffic on port 0/0 by our supplier

I see mirrored traffic on the foundry port that is connected to the
span destination port but the mirrored traffic is not forwarded across
the dot1q trunk towards the sniffer

I assumed the mirrored traffic would be flooded (unknown unicast mac
address) but what state are the MAC addresses on the mirrored
traffic??

Regards

Carl