Hi all,

I am currently performing asset detection in a network consisting of five Cisco 2K access switches. All access switches are connected to a main/core switch, where a traffic sniffer is attached.

Each switch (including the core switch) has endpoints connected, and I would like to capture traffic from all of them on the sniffer.

My initial configuration was as follows:

Access switches:

vlan 199 rspan-vlan

monitor session 1 source vlan 1,2,15,20 monitor session 1 destination remote vlan 199

Core/Main switch:

vlan 199 rspan-vlan

monitor session 1 source remote vlan 199 monitor session 1 destination interface Gi1/0/25 (sniffer)

monitor session 2 source vlan 1,2,14,20 monitor session 2 destination remote vlan 199

The configuration is accepted by the switches. However, on the sniffer I can only see traffic coming from the endpoints connected to the access switches.…