Cisco C3KX-SM-10G= User Manual

 

 

© 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. 

Page 12 of 14 

Figure 3.    Monitoring Locally Switched or Routed Traffic with Flow-Based Remote SPAN 

 

The following is the flow resulting from the mirrored RSPAN traffic: 

 

LAYER 2 DESTINATION VLAN ID:  666 

DATALINK ETHERTYPE:           0x0800 

MAC SOURCE ADDRESS:           0000.0400.0002 

MAC DESTINATION ADDRESS:      0000.0400.0003 

IPV4 SOURCE ADDRESS:          11.1.10.102 

IPV4 DESTINATION ADDRESS:     11.1.10.103 

TRNS SOURCE PORT:             1024 

TRNS DESTINATION PORT:        80 

interface input snmp index:   0 

interface output snmp index:  10202 

 

The differences with the PVLAN case are the VLAN ID, which is the RSPAN destination VLAN instead of the 

original access VLAN, and the fact that the input interface in the flow record is null (0) and the output interface is 

the service module port. The actual input and output interfaces can still be retrieved on the collector flow records 

for outbound traffic, by looking up the MAC and IPv4 source and destination address. 

Exporting to Ethernet Management port 

The Ethernet management port (FastEthernet0) is a dedicated routed interface used for out-of-band switch 

management services such as Telnet, Secure Shell (SSH) Protocol, Trivial File Transfer Protocol (TFTP), and 

SNMP. 

The service module FNF software injects exported traffic directly into the switch ASIC, where the forwarding is 

performed. By design, forwarding to/from FastEthernet0 from/to the switch ASIC is blocked in Cisco Catalyst 3560-

X and 3750-X switches.