--------------------------------------------------------------------------------
Note See the "Understanding How SPAN and RSPAN Work" section for concepts and terminology that apply to both SPAN and RSPAN configuration.

--------------------------------------------------------------------------------

RSPAN has all the features of SPAN (see the "Understanding How SPAN Works" section), plus support for source ports and destination ports that are distributed across multiple switches, allowing remote monitoring of multiple switches across your network.

The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches. The SPAN traffic from the sources is copied onto the RSPAN VLAN through the reflector port and then forwarded over trunk ports carrying the RSPAN VLAN to RSPAN destination ports monitoring the RSPAN VLAN.

Traffic sent out through the source port is also sent out on the reflector port. Because the reflector port is an access (nontrunking) port in loopback mode, the traffic is switched out with no VLAN tag and is immediately sent back to the switch. In the loopback, the traffic is encoded into the RSPAN VLAN. A switch with an RSPAN destination session receives the traffic (see Figure 26-2).

The traffic type for sources (ingress, egress, or both) in an RSPAN session can be different for source switches, but must be the same for all source ports on a given switch.

Do not configure any ports in an RSPAN VLAN except those selected to carry RSPAN traffic. Learning is disabled on the RSPAN VLAN.


Figure 26-2 Flow of RSPAN Monitored Traffic