Span And Rspan Concepts And Terminology - Cisco Catalyst 3550 series Software Configuration Manual

Chapter 24 Configuring SPAN and RSPAN

SPAN and RSPAN Concepts and Terminology

This section describes concepts and terminology associated with SPAN and RSPAN configuration.
SPAN Session
A local SPAN session is an association of a destination port with source ports and source VLANs. An
RSPAN session is an association of source ports and source VLANs across your network with an RSPAN
VLAN. The destination source is the RSPAN VLAN.
You configure SPAN sessions by using parameters that specify the source of network traffic to monitor.
Traffic monitoring in a SPAN session has these restrictions:
•
•
•
You can configure two separate SPAN or RSPAN sessions with separate or overlapping sets of SPAN
source ports and VLANs. Both switched and routed ports can be configured as SPAN sources and
destinations.
SPAN sessions do not interfere with the normal operation of the switch. However, an oversubscribed
SPAN destination, for example, a 10-Mbps port monitoring a 100-Mbps port, results in dropped or lost
packets.
You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active
unless you enable the destination port and at least one source port or VLAN for that session. The show
monitor session session_number privileged EXEC command displays the operational status of a SPAN
session.
A SPAN session remains inactive after system power-on until the destination port is operational.
Traffic Types
SPAN sessions include these traffic types:
•
78-11194-09
You can monitor incoming traffic on a series or range of ports and VLANs.
You can monitor outgoing traffic on a single port; you cannot monitor outgoing traffic on multiple
ports.
You cannot monitor outgoing traffic on VLANs.
Receive (Rx) SPAN—The goal of receive (or ingress) SPAN is to monitor as much as possible all
the packets received by the source interface or VLAN before any modification or processing is
performed by the switch. A copy of each packet received by the source is sent to the destination port
for that SPAN session. You can monitor a series or range of ingress ports or VLANs in a SPAN
session.
On tagged packets (Inter-Switch Link [ISL] or IEEE 802.1Q), the tagging is removed at the ingress
port. At the destination port, if tagging is enabled, the packets appear with the ISL or 802.1Q
headers. If no tagging is specified, packets appear in the native format.
Packets that are modified because of routing are copied without modification for Rx SPAN; that is,
the original packet is copied. Packets that are modified because of quality of service (QoS)—for
example, modified Differentiated Services Code Point (DSCP)—are copied with modification for Rx
SPAN.
Catalyst 3550 Multilayer Switch Software Configuration Guide
Understanding SPAN and RSPAN
24-3