49-3
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 49 Configuring SPAN, RSPAN and the Mini Protocol Analyzer
Understanding How SPAN and RSPAN Work
The source ports are administrative (
Admin Source
), operational (
Oper Source
), or both. The
administrative source ports are the source ports or the source VLANs that are specified during the SPAN
session configuration. The operational source ports are the source ports that are monitored by the
destination port. For example, when the source VLANs are used as the administrative source, the
operational source is all the ports in all the specified VLANs.
The operational sources are always the active ports. If a port is not in the spanning tree, it is not an
operational source. All physical ports in an EtherChannel source are included in the operational sources
if the logical port is included in the spanning tree.
The destination port, if it belongs to any of the administrative source VLANs, is excluded from the
operational source.
You can configure a port as a source port in multiple active SPAN sessions, but you cannot configure an
active source port as a destination port for any SPAN session.
If a SPAN session is inactive, the “oper source” field is not updated until the session becomes active.
The trunk ports can be configured as the source ports and can be mixed with the nontrunk source ports;
however, the encapsulation of the packets that are forwarded by the destination port are determined by
the trunk settings of the destination port during the SPAN session configuration.
Ingress SPAN
Ingress SPAN copies the network traffic that is received by the source ports for analysis at the destination
ports.
Egress SPAN
Egress SPAN copies the network traffic that is transmitted from the source ports for analysis at the
destination ports.
VSPAN
VLAN-based SPAN (VSPAN) is analysis of the network traffic in one or more VLANs. You can
configure VSPAN as ingress SPAN, egress SPAN, or both. All the ports in the source VLANs become
the operational source ports for the VSPAN session. The destination ports, if they belong to any of the
administrative source VLANs, are excluded from the operational source. If you add or remove the ports
from the administrative source VLANs, the operational sources are modified accordingly.
Use the following guidelines for VSPAN sessions:
•
The trunk ports are included as the source ports for the VSPAN sessions, but only the VLANs that
are in the Admin source list are monitored if these VLANs are active for the trunk.
•
For the VSPAN sessions with both ingress and egress SPAN configured, the system operates as
follows based upon the type of supervisor engine that you have:
–
WS-X6K-SUP1A-PFC, WS-X6K-SUP1A-MSFC, WS-X6K-S1A-MSFC2, WS-X6K-S2-PFC2,
WS-X6K-S1A-MSFC2, WS-SUP720, WS-SUP32-GE-3B, —Two packets are forwarded by the
SPAN destination port if the packets get switched on the same VLAN.
–
WS-X6K-SUP1-2GE, WS-X6K-SUP1A-2GE—Only one packet is forwarded by the SPAN
destination port.
•
An inband port is not included as Oper source for the VSPAN sessions.
