[c-nsp] Capturing remote trafic / RSPAN through non-Cisco

Jared Mauch jared at puck.nether.net
Fri Dec 12 12:45:00 EST 2014


> On Dec 12, 2014, at 12:38 PM, David Deutsch <david.deutsch at telna.com> wrote:
> 
> Hello all,
> 
> I have a 7201 router running an ITP image that is used as an SS7 STP, it in
> turn is connected to a Cisco 4948E which is trunked into a series of Dell
> M8024K blade switches (I know, I know). I've been tasked with capturing all
> of the IP traffic from the 7201 to a Wireshark machine, running on a blade
> server. Naturally I first looked to use RSPAN on the 4948 to capture the
> physical port connecting the 7201 and capture it via RSPAN on the blade.

Does the 4948E support ERSPAN?  If so, you can make the span destination
go to a remote IP address and decapsulate the traffic there.

- Jared




More information about the cisco-nsp mailing list