Span Nexus 5k traffic to layer 3 switch

[Nick C.]

Has anyone tried plugging a layer 3 switch into a destination SPAN port on nexus 5k? I need to see traffic on the 5k's and they do not support netflow.  Wondering if this workaround is feasible and if anyone has tried this yet.

[Kirk J]

Greetings.

What is your other L3 switch?  I would think it's port would have to be in a special 'monitor' type mode in order to accept all frames that ordinarily wouldn't get passed up to that port.  Almost seems like you would need to insert some sort of TAP device that is made for inspecting raw packets and doing netflow analysis.  Where are you doing the netflow analysis currently?

Thanks,

Kirk...

[Nick C.]

Hi thanks for the reply, Kirk.

Currently doing Netflow Analysis on my 7k's where the gateways live. We have host's on our 5k's in the same subnet, they never touch the 7k's if they are passing traffic between each other on the same VLAN. 

The L3 switch is a 3750. My idea is to use solarwinds to monitor netflow on the 3750 interface that plugs into the 5k span port. I figured, the 5k would span all traffic to this port, the 3750 would send the flow records to solarwinds which would analyze. 

Trying to avoid purchasing a separate piece of hardware just to see traffic on the Nexus 5596up.