•
Use the
no monitor session session number
command with no other parameters to clear the local SPAN
session number.
Local SPAN Traffic
Network traffic, including multicast, can be monitored using SPAN. Multicast packet monitoring is enabled
by default. In some SPAN configurations, multiple copies of the same source packet are sent to the SPAN
destination interface. For example, a bidirectional (both ingress and egress) SPAN session is configured for
sources a1 and a2 to a destination interface d1. If a packet enters the switch through a1 and gets switched to
a2, both incoming and outgoing packets are sent to destination interface d1; both packets would be the same
(unless a Layer-3 rewrite had occurred, in which case the packets would be different).
RSPAN Session
An RSPAN source session is an association of source ports or Vlans across your network with an RSPAN
Vlan. The RSPAN Vlan/BD on the router is the destination RSPAN session.
RSPAN Traffic
RSPAN supports source ports and source Vlans in the source switch and destination as RSPAN Vlan/BD.
The figure below shows the original traffic from the Host A to Host B via the source ports or Vlans on Host
A. The source ports or Vlans of Host A is mirrored to Host B using RSPAN Vlan 10. The traffic for each
RSPAN session is carried over a user-specified RSPAN Vlan that is dedicated for that RSPAN session in all
participating devices. The traffic from the source ports or Vlans are mirrored into the RSPAN Vlan and
forwarded over Trunk or the EVC bridge domain (BD) ports carrying the RSPAN Vlan to a destination session
monitoring the RSPAN Vlan.
Layer 2 Configuration Guide for Cisco NCS 4200 Series
10
Configuring Switched Port Analyzer
Local SPAN Traffic
