Span Examples - Cisco Catalyst 2000 Configuration Handbook

210 Cisco LAN Switching Configuration Handbook
Tip You also can configure more than one active RSPAN session at the destination
switch. The first session is created as shown previously. To create subsequent sessions, use
the create keyword. If create is omitted, the newly configured session overwrites the first
session. You should use a different RSPAN VLAN for each session.
(Intermediate switches only) No further configuration is needed.
4.
The switches in the path from RSPAN source to destination do not need to know
about any specific RSPAN configuration. After all the RSPAN VLANs have been cre-
ated end-to-end, the intermediate switches flood the RSPAN traffic correctly toward
the destinations. Remember that all the intermediate switches must be RSPAN-capa-
ble.
(Optional) Disable an RSPAN session:
5.
(config)no monitor session {session_number | all | local | range
session_range[[,session_range],...] | remote}
You can disable an RSPAN session when it is no longer needed. Source sessions are
identified by the rspan-vlan (VLAN number) or the all keyword. Destination ses-
sions are identified by the destination port as mod/port or the all keyword.

SPAN Examples

Network analyzer A (a "sniffer") is connected to a Catalyst switch port 5/1 and monitors
all traffic on VLAN 58.
A PC connects to port 4/39 and a file server to port 2/4 of a Catalyst switch. Network
analyzer B connects to port 5/48. The switch is configured for a SPAN session that allows
the analyzer to capture all traffic to and from the server. Figure 12-1 shows a network
diagram of the two SPAN sessions with the configuration following.
(global) monitor session 1 source vlan 58 both
(global) monitor session 1 destination interface fast 5/1
(global) monitor session 2 source interface fast 5/48 both
(global) monitor session 2 destination interface fast 2/4
Figure 12-2 shows a network of three switches. A file server is connected to Catalyst B
port 3/1. A network analyzer connects to Catalyst C port 5/48. Catalyst A connects
Catalysts B and C by two trunk ports. RSPAN VLAN 901 carries all the RSPAN traffic
from the source to the destination. (Assume for this example that Catalyst B is the VTP
server for the domain of three switches.)