Overview:
Local Switched Port Analyzer (SPAN) lets you monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports
Study Notes:
- SPAN monitors traffic from interface sources and sends traffic to destination interfaces
- SPAN sources can be Ethernet, port-channels or VLANs
- When VLANs are SPAN sources, all supported interfaces in the VLAN are SPAN sources
- SPAN source interfaces can monitor traffic in the receive direction, transmit direction or both directions
- SPAN source interfaces cannot also be SPAN destination interfaces
-
Local SPAN sources must be on the same host (linecard) as the Local SPAN destination port
-
SPAN destination ports receive copies of traffic for all monitored source ports
-
If a destination port is oversubscribed, it can become congested
-
Congestion can affect traffic forwarding on one or more of the source ports
- Local SPAN can replicate to one or more destination ports
- Traffic can be filtered so only traffic of interest is sent out the SPAN destination port
- Local SPAN can monitor all traffic received on an interface including BPDUs
- You can create up to 64 total span sessions on your device
- SPAN sessions are shutdown by default
- Typically, you will connect a network analyzer to the destination port
Configuring Local SPAN
- Configure a local SPAN session to capture receive traffic on port G0/10, capture transmit traffic on G0/11 and capture traffic in both directions on VLAN12. Set the destination SPAN ports to G0/20 and G0/21.
| SPAN Source | Traffic Direction | Destination ports |
| G0/10 | Receive | G0/20, G0/21 |
| G0/11 | Transmit | G0/20, G0/21 |
| VLAN12 | Both Receive and Transmit | G0/20, G0/21 |
Router>enable Router#config t Router(config)#no monitor session 1 Router(config)#monitor session 1 Router(config-monitor)#source interface G0/10 rx Router(config-monitor)#source interface G0/11 tx Router(config-monitor)#source vlan 12 Router(config-monitor)#destination interface G0/20, G0/21 Router(config-monitor)#no shut
Verifying Local SPAN
Router#show monitor session all Router#show monitor session 1 Router#show monitor
Removing a Local SPAN session
Router(config)#no monitor session 1