Table of Contents
Advertisement
Understanding How SPAN and RSPAN Work
Destination Port
A destination port (also called a monitor port) is a switch port where SPAN sends packets for analysis.
After a port becomes an active destination port, it does not forward any traffic except that required for
the SPAN session. By default, an active destination port disables incoming traffic (from the network to
the switching bus), unless you specifically enable the port. If incoming traffic is enabled for the
destination port, it is switched in the native VLAN of the destination port. The destination port does
not participate in spanning tree while the SPAN session is active. See the caution statement in the
"Configuring SPAN" section on page 25-6
topology.
Only one destination port is allowed per SPAN session, and the same port cannot be a destination port
for multiple SPAN sessions. A switch port configured as a destination port cannot be configured as a
source port or a reflector port. EtherChannel ports cannot be SPAN destination ports.
If the trunking mode of a SPAN destination port is "on" or "nonegotiate" during SPAN session
configuration, the SPAN packets forwarded by the destination port have the encapsulation specified by
the trunk type; however, the destination port stops trunking. The show trunk command reflects the
trunking status for the port prior to SPAN session configuration.
Source Port
A source port is a switch port monitored for network traffic analysis. The traffic through the source ports
can be categorized as ingress, egress, or both. You can monitor one or more source ports in a single SPAN
session with user-specified traffic types (ingress, egress, or both) applicable for all the source ports.
You can configure source ports in any VLAN. You can configure VLANs as source ports (src_vlans),
which means that all ports in the specified VLANs are source ports for the SPAN session.
Source ports are administrative (Admin Source) or operational (Oper Source) or both. Administrative
source ports are the source ports or source VLANs specified during SPAN session configuration.
Operational source ports are the source ports monitored by the destination port. For example, when
source VLANs are used as the administrative source, the operational source is all the ports in all the
specified VLANs.
The operational sources are always active ports. If a port is not in the spanning tree, it is not an
operational source. All physical ports in an EtherChannel source are included in operational sources if
the logical port is included in the spanning tree.
The destination port and reflector port, if they belong to any of the administrative source VLANs, are
excluded from the operational source.
You can configure a port as a source port in multiple active SPAN sessions, but you cannot configure an
active source port as a destination port or reflector port for any SPAN session.
If a SPAN session is inactive, the "oper source" field does not update until the session becomes active.
You can configure trunk ports as source ports and mix them with nontrunk source ports; however, the
trunk settings of the destination port during SPAN session configuration determine the encapsulation of
the packets forwarded by the destination port.
Software Configuration Guide—Catalyst 4000 Family, Catalyst 2948G, Catalyst 2980G, Releases 6.3 and 6.4
25-2
Chapter 25
for information on how to prevent loops in your network
Configuring SPAN and RSPAN
78-12647-02
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
