Use of RSPAN or ERSPAN with for asset radar logs

[DonMario73]

Hi, we have a customer that has dozens of vlans.  It won't be practical to install a scanning server in each one.   Has anybody implemented an additional scanning server that will be used to capture the traffic from other vlans using RSPAN or ERSPAN mirror ports?

Thanks for you comments

[Gilian · Accepted solution]

@DonMario73 yes, using port spanning will help you to gather info from other vlan's without having to install a scanning server in them.

Asset radar mainly uses ARP, DHCP, UDP and UDPv6 packets for recognition, so you could focus to forward only those to a network interface where asset radar is active.

If available, ERSPAN is recommended: SPAN is however limited to one switch, RSPAN is able to send traffic between switches but this traffic can't be routed. ERSPAN (Encapsulated Remote Switched Port Analyzer) solves this issue! It uses GRE encapsulation, this allows us to route SPAN traffic from a source to a destination.