20-2
Catalyst 2360 Switch Software Configuration Guide
OL-19808-01
Chapter 20 Configuring SPAN
Understanding SPAN
Local SPAN
Local SPAN supports a SPAN session entirely within one switch; all source ports or source VLANs and
destination ports are in the same switch. Local SPAN copies traffic from one or more source ports in any
VLAN or from one or more VLANs to a destination port for analysis. For example, in
, all
traffic on port 5 (the source port) is mirrored to port 10 (the destination port). A network analyzer on
port 10 receives all network traffic from port 5 without being physically attached to port 5.
Figure 20-1
Example of Local SPAN Configuration on a Single Switch
SPAN Concepts and Terminology
This section describes concepts and terminology associated with SPAN configuration.
SPAN Sessions
Local SPAN sessions allow you to monitor traffic on one or more ports, or one or more VLANs, and
send the monitored traffic to one or more destination ports.
A local SPAN session is an association of a destination port with source ports or source VLANs, all on
a single network device. Local SPAN does not have separate source and destination sessions. Local
SPAN sessions gather a set of ingress and egress packets specified by the user and form them into a
stream of SPAN data, which is directed to the destination port.
Traffic monitoring in a SPAN session has these restrictions:
•
Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same
session.
•
The switch supports only one SPAN source session.
•
You can have multiple destination ports in a SPAN session, but no more than 64 destination ports
per switch.
•
A SPAN session does not interfere with the normal operation of the switch. However, an
oversubscribed SPAN destination, for example, a 10-Mb/s port monitoring a 100-Mb/s port, can
result in dropped or lost packets.
1 2 3 4 5 6 7 8 9 10 11 12
Port 5 traffic mirrored
on Port 10
3
2
1
4
5
6
7
8
9
11
12
10
Network analyzer
43580
