CCNA 7.6.d: Local SPAN


Local Switched Port Analyzer (SPAN) lets you monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports


Study Notes:

  • SPAN monitors traffic from interface sources and sends traffic to destination interfaces
  • SPAN sources can be Ethernet, port-channels or VLANs
  • When VLANs are SPAN sources, all supported interfaces in the VLAN are SPAN sources
  • SPAN source interfaces can monitor traffic in the receive direction, transmit direction or both directions
  • SPAN source interfaces cannot also be SPAN destination interfaces
  • Local SPAN sources must be on the same host (linecard) as the Local SPAN destination port
  • SPAN destination ports receive copies of traffic for all monitored source ports
  • If a destination port is oversubscribed, it can become congested
  • Congestion can affect traffic forwarding on one or more of the source ports
  • Local SPAN can replicate to one or more destination ports
  • Traffic can be filtered so only traffic of interest is sent out the SPAN destination port
  • Local SPAN can monitor all traffic received on an interface including BPDUs
  • You can create up to 64 total span sessions on your device
  • SPAN sessions are shutdown by default
  • Typically, you will connect a network analyzer to the destination port


Configuring Local SPAN

  • Configure a local SPAN session to capture receive traffic on port G0/10, capture transmit traffic on G0/11 and capture traffic in both directions on VLAN12.  Set the destination SPAN ports to G0/20 and G0/21.




SPAN Source Traffic Direction Destination ports
G0/10 Receive G0/20, G0/21
G0/11 Transmit G0/20, G0/21
VLAN12 Both Receive and Transmit G0/20, G0/21


Router#config t
Router(config)#no monitor session 1
Router(config)#monitor session 1
Router(config-monitor)#source interface G0/10 rx
Router(config-monitor)#source interface G0/11 tx
Router(config-monitor)#source vlan 12
Router(config-monitor)#destination interface G0/20, G0/21
Router(config-monitor)#no shut


Verifying Local SPAN

Router#show monitor session all
Router#show monitor session 1
Router#show monitor


Removing a Local SPAN session

Router(config)#no monitor session 1
Leave a Reply
Built by TrailSix