Daren Matthews

Remote SPAN Configuration

Remote SPAN allows source ports and destination ports to be located on different switches. It uses a SPAN VLAN to transmit a copy of span data from source across the network to destination. You have to define and allow the SPAN VLAN in all network devices in the path.
Here’s how to do it:

UPDATE:

You might want to also try using the capture buffer: http://darenmatthews.com/blog/?p=546

1. Firstly, create a VLAN on each network switches in the path:
SW1(config)# vlan 456
SW1(config-vlan)# remote-span

(VLAN 456 is a remote span VLAN).

2. Setup the SPAN destination port, which is where the sniffer plugged to.

SW1(config)# monitor session 1 source remote vlan 456
SW1(config)# monitor session 1 destination interface gi4/1

3. If you want to monitor the host on SW2 port gi5/10 , the RSPAN session could be completed as follows:

SW2(config)# monitor session 1 source interface gi5/10
SW2(config)# monitor session 1 destination remote vlan 456

Recommended:

Wireshark Network Analysis
by Laura Chappell