[c-nsp] Capturing remote trafic / RSPAN through non-Cisco

David Deutsch david.deutsch at telna.com
Fri Dec 12 15:12:49 EST 2014


Marian,

I agree. However I haven't been able to locate such a command in the M8024K
documentation, can anyone chime in?

D

On Fri, Dec 12, 2014 at 2:02 PM, Marian Ďurkovič <md at bts.sk> wrote:
>
> Generally, RSPAN VLAN is a vlan, which has MAC learning disabled,
> so all packets are flooded via all ports.
> So if your M8024K has command to disable MAC learning in a VLAN,
> it's all you need (we're using that on other vendors' switches
> on daily basis).
>
>    With kind regards,
>
>        M.
>
> On Fri, 12 Dec 2014 12:38:02 -0500, David Deutsch wrote
> > Hello all,
> >
> > I have a 7201 router running an ITP image that is used as an SS7 STP,
> >  it in turn is connected to a Cisco 4948E which is trunked into a
> > series of Dell M8024K blade switches (I know, I know). I've been
> > tasked with capturing all of the IP traffic from the 7201 to a
> > Wireshark machine, running on a blade server. Naturally I first looked
> > to use RSPAN on the 4948 to capture the physical port connecting the
> > 7201 and capture it via RSPAN on the blade.
> >
> > However, it appears that the Dell M8024-K switches don't appear to have
> > RSPAN. The RSPAN frames are hitting the Dell infrastructure and not being
> > forwarded along the trunks (or this is what appears to be happening).
> > Is anyone aware of a RPAN vlan pass through method in the M8024K?
> >
> > Alternatively I was trying to figure a way to use QnQ on the 4948 or some
> > form of GRE on the 7201 itself to encapsulate the frames and get them
> > to the end Wireshark machine? I'm not against somehow using a cross
> > over cable to connect a SPAN to another switch port, but I don't have
> > a direct ethernet pass through available on the blade itself.
> >
> > Also if there is a process switch based solution on the 7201 itself
> > that can unicast the packets to a IP, I'd even take that.
> >
> > Thanks,
> >
> > David
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>


More information about the cisco-nsp mailing list