Document Number: OSUP1052
Product: Observer 10.0 and Up
Date: 10-12-2004
Title: VLAN Statistics
Keywords: VLAN ID, ISL, 802.1Q, SPAN, mirror, VLAN tag, VLAN encapsulation, No VLAN.
SYMPTOM:
No VLAN is the only VLAN ID that shows up in the VLANs column in VLAN Statistics. You don’t see all VLANs you have on the network.
REASONS:
To display VLAN Statistics, Observer checks each packet for a VLAN tag; if no tag is present, the packet is logged as "No VLAN." Both 802.1Q or ISL VLAN tags are stripped unless the SPAN destination port to which the analyzer is attached has been configured to include VLAN tags.
SOLUTIONS:
Configure the switch to retain the VLAN tags through the monitor port. This may be an option in the Mirror or SPAN command on the switch, or you may have to configure the port as a trunk prior to defining it as a SPAN port. Even if the switch is monitoring a trunk or uplink port it may strip VLAN tags unless you configure that port to retain the tags. Refer to the documentation that came with your switch for details on configuring VLANs, trunks, and analyzer ports.
*NOTE FOR CISCO USERS*
If connecting the analyzer to a Cisco switch, see the following link (it does require a TAC account):
http://www.cisco.com/en/US/customer/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml
If you use a Cisco Catalyst 4500/4000, 5500/5000, or 6500/6000 Series Switch running CatOS you must configure the destination port as a trunk port prior to configuring the SPAN port using the set trunk and set span commands, which have the following syntax:
set trunk module/port [on | off | desirable | auto | nonegotiate]
[vlan_range] [isl | dot1q | negotiate]
set span source_port destination_port [rx | tx | both]
For example, to configure module 6, port 2 for monitoring an 802.1Q VLAN setup, you would enter the following commands:
switch (enable) set trunk 6/2 nonegotiate dot1Q
switch (enable) set span 6/1 6/2
For Cisco Catalyst 2900/3500, 4500/4000 and 5500/5000 Series Switches Running IOS 12.1 or later, encapsulation forwarding is set as a part of the SPAN command, which has the following syntax:
monitor session session_number ( source | destination ) interface type/num [encapsulation ( dot1q | isl )]
For example, to monitor 802.1Q VLAN traffic passing through Fast Ethernet 02 via a SPAN port set up on Fast Ethernet 0/6, you would enter the following commands:
C4000 (config) # monitor session 1 source interface fastethernet 0/2
C4000 (config) # monitor session 1 destination interface fastethernet 0/6 encapsulation dot1Q
For a 6500/6000 Series Switch running Native IOS 12.1 or later you must configure the destination port as a trunk port prior to configuring the SPAN, which have the following syntax:
C6500(config)#Interface Type slot/port
C6500(config-if)#Switchport
C6500(config-if)#Switchport trunk encapsulation { ISL | dot1q }
C6500(config-if)#Switchport mode trunk
C6500(config-if)#Switchport nonnegotiate
For example, to monitor 802.1Q VLAN traffic passing through Fast Ethernet 02 via a SPAN port set up on Fast Ethernet 0/6, you would enter the following commands:
C6500 (config) # interface fastethernet 0/6
C6500 (config-if) #switchport
C6500 (config-if) #switchport trunk encapsulation dot1q
C6500 (config-if) #switchport mode trunk
C6500 (config-if) #switchport nonnegotiate
C6500 (config-if) #exit
C6500 (config) # monitor session 1 source interface fastethernet 0/2
C6500 (config) # monitor session 1 destination interface fastethernet 0/6 |
