Cisco 2960 X Owners Manual

SPAN Sessions
SPANsessions(localorremote)allowyoutomonitortrafficononeormoreports,oroneormoreVLANs,
andsendthemonitoredtraffictooneormoredestinationports.
AlocalSPANsessionisanassociationofadestinationportwithsourceportsorsourceVLANs,allona
singlenetworkdevice.LocalSPANdoesnothaveseparatesourceanddestinationsessions.LocalSPAN
sessionsgatherasetofingressandegresspacketsspecifiedbytheuserandformthemintoastreamofSPAN
data,whichisdirectedtothedestinationport....

◦AnRSPANsourcesessioncannothavealocaldestinationport.
◦AnRSPANdestinationsessioncannothavealocalsourceport.
◦AnRSPANdestinationsessionandanRSPANsourcesessionthatareusingthesameRSPAN
VLANcannotrunonthesameswitchorswitchstack.
Related Topics
CreatingaLocalSPANSession,onpage78
CreatingaLocalSPANSessionandConfiguringIncomingTraffic,onpage80
Example:ConfiguringLocalSPAN,onpage93
Monitored Traffic
SPANsessionscanmonitorthesetraffictypes:...

Switchcongestioncancausepacketstobedroppedatingresssourceports,egresssourceports,orSPAN
destinationports.Ingeneral,thesecharacteristicsareindependentofoneanother.Forexample:
•ApacketmightbeforwardednormallybutdroppedfrommonitoringduetoanoversubscribedSPAN
destinationport.
•Aningresspacketmightbedroppedfromnormalforwarding,butstillappearontheSPANdestination
port.
•AnegresspacketdroppedbecauseofswitchcongestionisalsodroppedfromegressSPAN....

•IfportsareaddedtoorremovedfromthesourceVLANs,thetrafficonthesourceVLANreceivedby
thoseportsisaddedtoorremovedfromthesourcesbeingmonitored.
•YoucannotusefilterVLANsinthesamesessionwithVLANsources.
•YoucanmonitoronlyEthernetVLANs.
VLAN Filtering
Whenyoumonitoratrunkportasasourceport,bydefault,allVLANsactiveonthetrunkaremonitored.
YoucanlimitSPANtrafficmonitoringontrunksourceportstospecificVLANsbyusingVLANfiltering.
•VLANfilteringappliesonlytotrunkportsortovoiceVLANports....

•ItcanparticipateinonlyoneSPANsessionatatime(adestinationportinoneSPANsessioncannotbe
adestinationportforasecondSPANsession).
•Whenitisactive,incomingtrafficisdisabled.Theportdoesnottransmitanytrafficexceptthatrequired
fortheSPANsession.Incomingtrafficisneverlearnedorforwardedonadestinationport.
•Ifingresstrafficforwardingisenabledforanetworksecuritydevice,thedestinationportforwardstraffic
atLayer2.
•ItdoesnotparticipateinanyoftheLayer2protocols(STP,VTP,CDP,DTP,PagP)....

CreatinganRSPANDestinationSessionandConfiguringIncomingTraffic,onpage90
Examples:CreatinganRSPANVLAN,onpage94
SPAN and RSPAN Interaction with Other Features
SPANinteractswiththesefeatures:
•Routing—SPANdoesnotmonitorroutedtraffic.VSPANonlymonitorstrafficthatentersorexitsthe
switch,nottrafficthatisroutedbetweenVLANs.Forexample,ifaVLANisbeingRx-monitoredand
theswitchroutestrafficfromanotherVLANtothemonitoredVLAN,thattrafficisnotmonitoredand
notreceivedontheSPANdestinationport....

ForSPANsessions,donotenableIEEE802.1xonportswithmonitoredegresswheningressforwarding
isenabledonthedestinationport.ForRSPANsourcesessions,donotenableIEEE802.1xonanyports
thatareegressmonitored.
SPAN and RSPAN and Device Stacks
Becausethestackofswitchesrepresentsonelogicalswitch,localSPANsourceportsanddestinationports
canbeindifferentswitchesinthestack.Therefore,theadditionordeletionofswitchesinthestackcanaffect
alocalSPANsession,aswellasanRSPANsourceordestinationsession.Anactivesessioncanbecome...

CreatingaLocalSPANSessionandConfiguringIncomingTraffic,onpage80
Example:ConfiguringLocalSPAN,onpage93
RSPAN Configuration Guidelines
•AlltheSPANconfigurationguidelinesapplytoRSPAN.
•AsRSPANVLANshavespecialproperties,youshouldreserveafewVLANsacrossyournetworkfor
useasRSPANVLANs;donotassignaccessportstotheseVLANs.
•YoucanapplyanoutputACLtoRSPANtraffictoselectivelyfilterormonitorspecificpackets.Specify
theseACLsontheRSPANVLANintheRSPANsourceswitches....

DETAILED STEPS
PurposeCommand or Action
Enterstheglobalconfigurationmode.configureterminal
Example:
Switch#configureterminal
Step 1
RemovesanyexistingSPANconfigurationforthesession.nomonitorsession{session_number|
all|local|remote}
Step 2
•Forsession_number,therangeis1to66.
Example:
Switch(config)#nomonitorsessionall
•all—RemovesallSPANsessions.
•local—Removesalllocalsessions.
•remote—RemovesallremoteSPANsessions.
SpecifiestheSPANsessionandthesourceport(monitoredport).monitorsessionsession_numbersource...

PurposeCommand or Action
•Forsession_number,specifythesessionnumberenteredinstep3.
Example:
Switch(config)#monitorsession1
•Forinterface-id,specifythedestinationport.Thedestinationinterfacemust
beaphysicalport;itcannotbeanEtherChannel,anditcannotbeaVLAN.
destinationinterface•(Optional)[,|-]Specifiesaseriesorrangeofinterfaces.Enteraspacebefore
andafterthecomma;enteraspacebeforeandafterthehyphen.gigabitethernet1/0/2encapsulationreplicate
(Optional)encapsulationreplicatespecifiesthatthedestinationinterface...