SPAN capturing control packets
By default, SPAN and RSPAN sessions will only send untagged packets to the destination port. In addition, control traffic such as CDP, DTP, VTP, STP, PAgP, LACP and others are not captured by default. However, you can use the encapsulation replicate keywords when configuring a destination port, and the following will take place:
- Packets are sent to the destination port with the same encapsulation as they arrive on the monitored port, whether tagged or untagged.
- Packets of all types, including those of the protocols mentioned above, for both layer 2 and layer 3 are also captured and sent to the destination port.
Now note that this is only the case for local SPAN. RSPAN does not support the encapsulation replicate functionality, so if you want to capture STP packets and BPDUs, then you must use SPAN.