Cisco IE 4000, Software Configuration Manual

Page: 469 / 1066

465
Cisco Systems, Inc. www.cisco.com
Configuring SPAN and RSPAN
Prerequisites for SPAN and RSPAN

You must globally configure the ip device tracking maximum limit-number interface configuration command
globally for IPSG for static hosts to work. If you only configure this command on a port without enabling IP device
tracking globally or setting an IP device tracking maximum on that interface, IPSG with static hosts will reject all the
IP traffic from that interface. This requirement also applies to IPSG with static hosts on a Layer 2 access port.
Information About SPAN and RSPAN
SPAN and RSPAN
You can analyze network traffic passing through ports or VLANs by using Switched Port Analyzer (SPAN) or Remote SPAN
(RSPAN) to send a copy of the traffic to another port on the switch or on another switch that has been connected to a
network analyzer or other monitoring or security device. SPAN copies (or mirrors) traffic received or sent (or both) on
source ports or source VLANs to a destination port for analysis. SPAN does not affect the switching of network traffic on
the source ports or VLANs. You must dedicate the destination port for SPAN use. Except for traffic that is required for
the SPAN or RSPAN session, destination ports do not receive or forward traffic.
Only traffic that enters or leaves source ports or traffic that enters or leaves source VLANs can be monitored by using
SPAN; traffic routed to a source VLAN cannot be monitored. For example, if incoming traffic is being monitored, traffic
that gets routed from another VLAN to the source VLAN cannot be monitored; however, traffic that is received on the
source VLAN and routed to another VLAN can be monitored.
You can use the SPAN or RSPAN destination port to inject traffic from a network security device. For example, if you
connect a Cisco Intrusion Detection System (IDS) sensor appliance to a destination port, the IDS device can send TCP
reset packets to close down the TCP session of a suspected attacker.
Local SPAN
Local SPAN supports a SPAN session entirely within one switch; all source ports or source VLANs and destination ports
are in the same switch. Local SPAN copies traffic from one or more source ports in any VLAN or from one or more VLANs
to a destination port for analysis. For example, in
Figure 69 on page 466 , all traffic on port 5 (the source port) is mirrored
to port 10 (the destination port). A network analyzer on port 10 receives all network traffic from port 5 without being
physically attached to port 5.