49-2
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 49 Configuring SPAN, RSPAN and the Mini Protocol Analyzer
Understanding How SPAN and RSPAN Work
•
Trunk VLAN Filtering, page 49-4
•
SPAN Traffic, page 49-4
SPAN Session
A SPAN session is an association of destination ports with a set of source ports, configured with the
parameters that specify the monitored network traffic. You can configure multiple SPAN sessions in a
switched network. The SPAN sessions do not interfere with the normal operation of the switches. You
can enable or disable the SPAN sessions with the command-line interface (CLI) or SNMP commands.
When enabled, a SPAN session might become active or inactive based on various events or actions, and
this would be indicated by a syslog message. The “Status” field in the
show span
and
show rspan
commands displays the operational status of a SPAN or RSPAN session.
A SPAN or RSPAN destination session remains inactive after system power up until the destination ports
are operational. An RSPAN source session remains inactive until any of the source ports are operational
or the RSPAN VLAN becomes active.
Destination Port
A destination port (also called a
monitor port
) is an access port where SPAN sends the packets for
analysis. After a port becomes an active destination port, it does not forward any traffic except that
required for the SPAN session. By default, an active destination port disables the incoming traffic (from
the network to the switching bus), unless you specifically enable the port. If the incoming traffic is
enabled for the destination port, it is switched in the native VLAN of the destination port. The destination
port does not participate in spanning tree while the SPAN session is active. See the caution statement in
the
“Configuring SPAN from the CLI” section on page 49-8
for information on how to prevent loops in
your network topology.
Multiple destination ports can be specified in each local SPAN session but a destination port cannot be
a destination port for multiple SPAN sessions. An access port that is configured as a destination port
cannot be configured as a source port. EtherChannel ports cannot be SPAN destination ports.
If the trunking mode of a SPAN destination port is “on” or “nonegotiate” during the SPAN session
configuration, the SPAN packets that are forwarded by the destination port have the encapsulation as
specified by the trunk type; however, the destination port stops trunking, and the
show trunk
command
reflects the trunking status for the port prior to the SPAN session configuration.
Source Port
A source port is an access port that is monitored for network traffic analysis. The traffic through the
source ports can be categorized as ingress, egress, or both. You can monitor one or more source ports in
a single SPAN session with the user-specified traffic types (ingress, egress, or both) applicable for all
the source ports.
You can configure the source ports in any VLAN. You can configure the VLANs as the source ports
(
src_vlans
), which means that all the ports in the specified VLANs are the source ports for the SPAN
session.
