[c-nsp] questions regarding RSPAN on Catalyst 2950, 3550, 3560, 3750 and 4500 platforms

[Martin T]

If I execute "no monitor session 2" in "WS-C3560G-24TS" port Gi0/11
changes from "monitoring" status to "inactive" and I can see only
CDPv2 messages in "PE860". This is expected as Gi0/11 is in
"remote-span" VLAN. If I change Gi0/11 to trunk I can see the very
same IPv6 traffic in "PE860" + other protocols. Now if I check this
IPv6 traffic more closely I can see that all the packets are addressed
to "Link-Local Scope Multicast
Addresses"(http://www.iana.org/assignments/ipv6-multicast-addresses/ipv6-multicast-addresses.xml).
For example ff02::1(All Nodes Address),
ff02::1:ff18:f2d2(Solicited-Node Address), ff02::1:2(All-dhcp-agents),
ff02::fb(mDNSv6) etc.
Why is only IPv6 traffic sent to "monitor" port(Gi0/11) when RSPAN on
"WS-C3560G-24TS" is enabled?


regards,
Martin

2012/10/2, Saku Ytti <saku at ytti.fi>:
> On 2 October 2012 10:25, Martin T <m4rtntns at gmail.com> wrote:
>
>> Any other ideas?
>
> Not really, seems like your SPAN might not be doing anything at all.
> Can you confirm this by removing SPAN config, leaving port just as
> trunk, and see if you capture same set of packets?
>
> --
>   ++ytti
>