26-2
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Chapter 26 Configuring SPAN
Understanding SPAN
Local SPAN
Local SPAN supports a SPAN session entirely within one switch; all source ports or source VLANs and
destination ports are in the same switch. Local SPAN copies traffic from one or more source ports in any
VLAN or from one or more VLANs to a destination port for analysis. For example, in
traffic on port 5 (the source port) is mirrored to port 10 (the destination port). A network analyzer on
port 10receives all network traffic from port 5 without being physically attached to port 5.
Figure 26-1
Example of Local SPAN Configuration on a Single Switch
SPAN Concepts and Terminology
This section describes concepts and terminology associated with SPAN configuration.
SPAN Sessions
SPAN sessions allow you to monitor traffic on one or more ports, or one or more VLANs, and send the
monitored traffic to one or more destination ports.
A local SPAN session is an association of a destination port with source ports or source VLANs, all on
a single network device. Local SPAN does not have separate source and destination sessions. Local
SPAN sessions gather a set of ingress and egress packets specified by the user and form them into a
stream of SPAN data, which is directed to the destination port.
Traffic monitoring in a SPAN session has these restrictions:
•
Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same
session.
•
The switch supports up to two source sessions (local SPAN source sessions). You can run both a
local SPAN source session in the same switch. The switch supports a total of 66 source destination
sessions.
•
You can have multiple destination ports in a SPAN session, but no more than 64 destination ports.
•
You can configure two separate SPAN source sessions with separate or overlapping sets of SPAN
source ports and VLANs.
1 2 3 4 5 6 7 8 9 10 11 12
Port 5 traffic mirrored
on Port 10
3
2
1
4
5
6
7
8
9
11
12
10
Network analyzer
43580
