Preserving encapsulation across SPAN

Posted by stretch in Networking on Thursday, 1 May 2008 at 2:02 a.m. GMT

The other day I was attempting to analyze traffic traversing an 802.1Q trunk via SPAN, and I noticed the trunk headers were missing. I also noticed I wasn't seeing the typical background traffic like STP and CDP. A bit of poking around suggested I needed to configure SPAN to replicate the source 802.1Q encapsulation. 

Switch(config)# monitor session 1 source interface g0/1
Switch(config)# monitor session 1 destination interface g0/2 encapsulation replicate

Alternatively, the encapsulation can be explicitly configured as either 802.1q or ISL. After modifying the SPAN session I was seeing all traffic as expected. Seems strange that this isn't done by default.

Rodrigo commented on 1 May 2008 at 2:56 a.m.

Your blog, more specifically your cheat sheets help me on passing on BCMSN exam :)

And your blog is very interesting, you raise interesting questions.

Congratulations!

Leave a comment
(optional, will not be published)
(optional)

Comment Tips

  • You can use Markdown syntax for decoration. (Cheat sheet)
  • Links: [Google](http://google.com) or <http://google.com>
  • Use backticks around commands: `ip address 127.0.0.1`
  • Use indentations (tabs) for preformatted text (code blocks)