52-2
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
OL-4266-08
Chapter 52 Configuring Local SPAN, RSPAN, and ERSPAN
Understanding How Local SPAN, RSPAN, and ERSPAN Work
Local SPAN, RSPAN, and ERSPAN Overview
Local SPAN, RSPAN, and ERSPAN sessions allow you to monitor traffic on one or more ports, or one
or more VLANs, and send the monitored traffic to one or more destination ports. With Release
12.2(18)SXD and later releases, you can configure per-VLAN filtering on destination trunk ports.
Local SPAN, RSPAN, and ERSPAN all send traffic to a network analyzer such as a SwitchProbe device
or other Remote Monitoring (RMON) probe. SPAN does not affect the switching of traffic on source
ports or VLANs. SPAN sends a copy of the packets received or transmitted by the source ports and
VLANs to the destination port. You must dedicate the destination port for SPAN use.
These sections provide an overview of local SPAN, RSPAN, and ERSPAN:
•
Local SPAN Overview, page 52-2
•
RSPAN Overview, page 52-3
•
ERSPAN Overview, page 52-4
•
Monitored Traffic, page 52-4
Local SPAN Overview
A local SPAN session is an association of source ports and source VLANs with one or more destination
ports. You configure a local SPAN session on a single router. Local SPAN does not have separate source
and destination sessions.
Local SPAN sessions do not copy locally sourced RSPAN VLAN traffic from source trunk ports that
carry RSPAN VLANs. Local SPAN sessions do not copy locally sourced RSPAN GRE-encapsulated
traffic from source ports.
Each local SPAN session can have either ports or VLANs as sources, but not both.
Local SPAN copies traffic from one or more source ports in any VLAN or from one or more VLANs to
a destination port for analysis (see
Figure 52-1
). For example, as shown in
Figure 52-1
, all traffic on
Ethernet port 5 (the source port) is copied to Ethernet port 10. A network analyzer on Ethernet port 10
receives all traffic from Ethernet port 5 without being physically attached to Ethernet port 5.
Figure 52-1 Example SPAN Configuration
1 2 3 4 5 6 7 8 9 10 11 12
Port 5 traffic mirrored
on port 10
E3
E2
E1
E4
E5
E6 E7
E8
E9
E11
E12
E10
Network analyzer
S6884
