2-178
Catalyst 2350 Switch Command Reference
OL-19055-01
Chapter 2 Catalyst 2350 Switch Cisco IOS Commands
monitor session
When you use VLAN-based SPAN (VSPAN) to analyze network traffic in a VLAN or set of VLANs, all
active ports in the source VLANs become source ports for the SPAN or RSPAN session. Trunk ports are
included as source ports for VSPAN, and only packets with the monitored VLAN ID are sent to the
destination port.
You can monitor traffic on a single port or VLAN or on a series or range of ports or VLANs. You select
a series or range of interfaces or VLANs by using the [
,
|
-
] options.
If you specify a series of VLANs or interfaces, you must enter a space before and after the comma. If
you specify a range of VLANs or interfaces, you must enter a space before and after the hyphen (
-
).
EtherChannel ports cannot be configured as SPAN or RSPAN destination ports. A physical port that is
a member of an EtherChannel group can be used as a destination port, but it cannot participate in the
EtherChannel group while it is as a SPAN destination.
You can monitor individual ports while they participate in an EtherChannel, or you can monitor the
entire EtherChannel bundle by specifying the
port-channel
number as the RSPAN source interface.
A port used as a destination port cannot be a SPAN or RSPAN source, nor can a port be a destination
port for more than one session at a time.
VLAN filtering refers to analyzing network traffic on a selected set of VLANs on trunk source ports. By
default, all VLANs are monitored on trunk source ports. You can use the
monitor session
session_number
filter vlan
vlan-id
command to limit SPAN traffic on trunk source ports to only the
specified VLANs.
VLAN monitoring and VLAN filtering are mutually exclusive. If a VLAN is a source, VLAN filtering
cannot be enabled. If VLAN filtering is configured, a VLAN cannot become a source.
If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic
at Layer 2.
Destination ports can be configured to act in these ways:
•
When you enter
monitor session
session_number
destination
interface
interface-id
with no other
keywords, egress encapsulation is untagged, and ingress forwarding is not enabled.
•
When you enter
monitor session
session_number
destination
interface
interface-id
ingress
, egress
encapsulation is untagged; ingress encapsulation depends on the keywords that follow—
dot1q
,
isl
,
or
untagged
.
•
When you enter
monitor session
session_number
destination
interface
interface-id
encapsulation
replicate
with no other keywords, egress encapsulation replicates the source interface
encapsulation; ingress forwarding is not enabled. (This applies to local SPAN only; RSPAN does
not support encapsulation replication.)
•
When you enter
monitor session
session_number
destination
interface
interface-id
encapsulation
replicate ingress
, egress encapsulation replicates the source interface encapsulation; ingress
encapsulation depends on the keywords that follow—
dot1q
or
untagged
. (This applies to local
SPAN only; RSPAN does not support encapsulation replication.)
Examples
This example shows how to create a local SPAN session 1 to monitor both sent and received traffic on
source port 1 to destination port 2:
Switch(config)#
monitor session 1 source interface gigabitethernet0/1 both
Switch(config)#
monitor session 1 destination interface gigabitethernet0/2
This example shows how to delete a destination port from an existing local SPAN session:
Switch(config)#
no monitor session 2 destination gigabitethernet0/2
