Span Concepts And Terminology; Span Session; Traffic Types - Cisco Catalyst 2950 Software Manual

Chapter 10 Configuring the Switch Ports
SPAN does not affect the switching of network traffic on source ports; a copy of the packets received or
sent by the source interfaces are sent to the destination interface. However, an oversubscribed SPAN
destination, for example, a 10-Mbps port monitoring a 100-Mbps port, can cause congestion on the
switch. Destination ports do not receive or forward traffic, except that required for the SPAN session.

SPAN Concepts and Terminology

This section describes concepts and terminology associated with SPAN configuration.

SPAN Session

A SPAN session is an association of a destination port with source ports. You can monitor incoming or
outgoing traffic on a series or range of ports.
SPAN sessions do not interfere with the normal operation of the switch.
You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active
unless you enable the destination port and at least one source port. The show monitor session
session_number privileged EXEC command displays the operational status of a SPAN session.
A SPAN session remains inactive after system power-on until the destination port is operational.

Traffic Types

SPAN sessions include these traffic types:
•
•
78-11380-03
Receive (Rx) SPAN—The goal of receive (or ingress) SPAN is to monitor as much as possible all
the packets received by the source interface. A copy of each packet received by the source is sent to
the destination port for that SPAN session. You can monitor a series or range of ingress ports in a
SPAN session.
At the destination port, the packets are seen with the 802.1Q tag, but packets from the switch CPU
to the destination port are without the 802.1Q tag.
Packets that are modified because of quality of service (QoS)—for example, modified Differentiated
Services Code Point (DSCP)—are copied with modification for Rx SPAN.
Some features that can cause a packet to be dropped during receive processing have no effect on
SPAN; the destination port receives a copy of the packet even if the actual incoming packet is
dropped. These features include IP standard and extended input access control lists (ACLs), IP
standard and extended output ACLs for unicast and ingress QoS policing. Switch congestion that
causes packets to be dropped also has no effect on SPAN.
Transmit (Tx) SPAN—The goal of transmit (or egress) SPAN is to monitor as much as possible all
the packets sent by the source interface after all modification and processing is performed by the
switch. A copy of each packet sent by the source is sent to the destination port for that SPAN session.
The copy is provided after the packet is modified. You can monitor a range of egress ports in a SPAN
session.
On packets that are modified because of QoS, the modified packet might not have the same DSCP
(IP packet) or CoS (non-IP packet) as the SPAN source.
Catalyst 2950 Desktop Switch Software Configuration Guide
Understanding SPAN
10-19