[c-nsp] Capturing remote trafic / RSPAN through non-Cisco

David Deutsch david.deutsch at telna.com
Fri Dec 12 12:38:02 EST 2014


Hello all,

I have a 7201 router running an ITP image that is used as an SS7 STP, it in
turn is connected to a Cisco 4948E which is trunked into a series of Dell
M8024K blade switches (I know, I know). I've been tasked with capturing all
of the IP traffic from the 7201 to a Wireshark machine, running on a blade
server. Naturally I first looked to use RSPAN on the 4948 to capture the
physical port connecting the 7201 and capture it via RSPAN on the blade.

However, it appears that the Dell M8024-K switches don't appear to have
RSPAN. The RSPAN frames are hitting the Dell infrastructure and not being
forwarded along the trunks (or this is what appears to be happening). Is
anyone aware of a RPAN vlan pass through method in the M8024K?

Alternatively I was trying to figure a way to use QnQ on the 4948 or some
form of GRE on the 7201 itself to encapsulate the frames and get them to
the end Wireshark machine? I'm not against somehow using a cross over cable
to connect a SPAN to another switch port, but I don't have a direct
ethernet pass through available on the blade itself.

Also if there is a process switch based solution on the 7201 itself that
can unicast the packets to a IP, I'd even take that.

Thanks,

David


More information about the cisco-nsp mailing list