SPAN traffic collection

[TheVMinator]

If i am collecting traffic by configuring SPAN on virtual port groups, do I have to have a collector on every ESXi host, or is there a way to ship span traffic across the network to one centralized collector?

[rcporto]

You can configure a RSPAN session to send traffic to a centralized collector: vSphere 5.1 – VDS Feature Enhancements – Port Mirroring – Part 3 | VMware vSphere Blog - VMware Blog...

[TheVMinator]

OK thanks.  I can send an RSPAN session over a network to a centralized collector, but can that collector be on a different subnet over a router or does it have to be on the same subnet?

[rcporto]

The RSPAN mirror traffic accross layer 2 network, this way you don't need to worry about IP address, but just make sure configure the RSPAN VLAN.

At the bottom of the link I provide you can see another way to send traffic to a remote collector, that is using ERSPAN, that will encapsulate mirror traffic accross layer 3, take a look:

VDS also supports ERSPAN capability where you will not require any configuration changes on the physical switches. You just need the IP address of the destination virtual machine or analyzer. Just select the “Encapsulated Remote Mirroring (L3) source” option for the session type and walk step-by-step through the wizard. For the source select the ports you want to monitor and for the destination enter the IP address of the virtual machine or analyzer.