SPAN - jibingl/CCNA-CCNP GitHub Wiki

Switched Port Analyzer (SPAN), or port mirroring, is a feature on managed network switches that copies traffic from specific source ports or VLANs and sends it to a destination port for monitoring, troubleshooting, or security analysis.

(learningnetwork.cisco.com)

Terminology	Description
Source (SPAN) port	A port that is monitored by SPAN feature.
Source (SPAN) VLAN	A VLAN that is monitored by SPAN feature.
Destination (SPAN) port	A port which monitored traffic destine to, usually where a network analyzer is connected.
Remote SPAN VLAN	A designated VLAN for relaying monitored traffic to a remote destination port. Only for RSPAN concept.
Monitor port	A monitor port is also a destination SPAN port in Catalyst 2900XL/3500XL/2950 terminology.
Local SPAN	The SPAN feature is local when the monitored source ports are all located on the same switch as the destination port.
Remote SPAN (RSPAN)	Some source ports are not located on the same switch as the destination port.

Configuration

SPAN

! Configure the destination port
interface FastEthernet 4/15
 switchport mode access
 no shutdown
!
! Create SPAN session 1
monitor session 1 source interface FastEthernet 4/10 both
monitor session 1 destination interface FastEthernet 4/15

RSPAN

You must create the exact same VLAN on all switches in the path and explicitly define it as an RSPAN VLAN. (e.g., two switches)

! Run this on two switches 
configure terminal
vlan 900
 name RSPAN_VLAN
 remote-span
exit

Source switch captures traffic from a local port and sends it into the remote VLAN.
Destination switch receives the traffic from the remote VLAN and forwards it out a local port to your packet analyzer.

! On the Source Switch
monitor session 1 source interface FastEthernet 0/1 both
monitor session 1 destination remote vlan 900


! On the Destination Switch
monitor session 2 source remote vlan 900
monitor session 2 destination interface FastEthernet 0/5

ERSPAN

! On the Source Switch
monitor session 1 type erspan-source
 source interface Gig 0/1 both
 source erspan-id 10
 destination
  ip address 192.168.20.50
  origin ip address 192.168.10.10


! On the Destination Switch
monitor session 3 type erspan-destination
 destination interface Gig 1/1
 destination erspan-id 10
 source
  ip address 192.168.10.10