Configuring SPAN

Summary: Networking › Switching › Edge › Synapse

Overview of SPAN

You can analyze network traffic passing through ports by using SPAN（Local Switched Port Analyzer）to send a copy of the traffic to another port on the switch that has been connected to a network analyzer or other monitoring or security device. SPAN copies traffic received or sent (or both) on source ports to a destination port for analysis. SPAN does not affect the switching of network traffic on the source ports. You must dedicate the destination port for SPAN use. Except for traffic that is required for the SPAN session, destination ports do not receive or forward traffic.

Example of SPAN configuration

SPAN supports a session entirely within one switch. all source ports and destination ports are in the same switch. SPAN sessions allow you to monitor traffic on one or more ports, and send the monitored traffic to only one destination port. A SPAN session is an association of a destination port with source ports, all on a single network device.

Configuring

• Creating a Session

SWITCH(config)#monitor session SESSION-ID

SWITCH(config)#no monitor session SESSION-ID

Create a SPAN session. For session_number, the range is 1 to 7

SWITCH(config-monitor)#description DESC

Add a description (up to 64 characters) for an interface

SWITCH(config-monitor)#source interface IFNAME {both | rx | tx}

SWITCH(config-monitor)#no source interface IFNAME {both | rx | tx}

Specify the SPAN session and the source port.

SWITCH(config-monitor)#destination interface IFNAME

SWITCH(config-monitor)#no destination interface IFNAME

Specify the SPAN session and the destination port.

Examples

Example 1： This example shows how to create SPAN session, and configure session source interfaces and destination interface. Step 1: Create session.

SWITCH#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

SWITCH(config)#monitor session 1

SWITCH(config-monitor)#

Step 2: Configuring session description.

SWITCH(config-monitor)#description TRAFFIC_MONITOR

Step 3: Configuring session source interfaces.

SWITCH(config-monitor)#source interface gigabitEthernet0/1 rx

SWITCH(config-monitor)#source interface gigabitEthernet0/2 both

Step 4: Configuring session destination interface.

SWITCH(config-monitor)#destination interface gigabitEthernet0/8

Display information

• Display Single Session

SWITCH#show monitor session 1

session 1 ————— description : TRAFFIC_MONITOR type : local source intf : tx : gigabitEthernet0/2 rx : gigabitEthernet0/1 gigabitEthernet0/2 both : gigabitEthernet0/2 source VLANs : rx : destination ports : gigabitEthernet0/8 Legend: f = forwarding enabled, l = learning enabled