Span And Rspan Concepts And Terminology - Cisco Catalyst 4500 Series Configuration Manual

Chapter 55 Configuring SPAN and RSPAN

SPAN and RSPAN Concepts and Terminology

This section describes concepts and terminology associated with SPAN and RSPAN configuration and
includes the following subsections:
•
•
•
•
•
•
SPAN Session
A local SPAN session associates a destination port with source ports. You can monitor incoming or
outgoing traffic on a series or range of ports and source VLANs. An RSPAN session associates source
ports and source VLANs across your network with an RSPAN VLAN. The destination source is the
RSPAN VLAN.
You configure SPAN sessions by using parameters that specify the source of network traffic to monitor.
You can configure multiple SPAN or RSPAN sessions with separate or overlapping sets of SPAN
sources. Both switched and routed ports can be configured as SPAN sources or destination ports.
An RSPAN source session associates SPAN source ports or VLANs with a destination RSPAN VLAN.
An RSPAN destination session associates an RSPAN VLAN with a destination port.
SPAN sessions do not interfere with the normal operation of the switch; however, an oversubscribed
SPAN destination (for example, a 10-Mbps port monitoring a 100-Mbps port) results in dropped or lost
packets.
You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active
unless you enable the destination port and at least one source port or VLAN for that session.
A SPAN session remains inactive after system startup until the destination port is operational.
Traffic Types
SPAN sessions include these traffic types:
•
OL-25340-01
SPAN Session, page 55-3
Traffic Types, page 55-3
Source Port, page 55-4
Destination Port, page 55-5
VLAN-Based SPAN, page 55-5
SPAN Traffic, page 55-6
Receive (Rx) SPAN—The goal of receive (or ingress) SPAN is to monitor as much as possible all
packets received by the source interface or VLAN before any modification or processing is
performed by the switch. A copy of each packet received by the source is sent to the destination port
for that SPAN session. You can monitor a series or range of ingress ports or VLANs in a SPAN
session.
On tagged packets (Inter-Switch Link IEEE 802.1Q), the tagging is removed at the ingress port. At
the destination port, if tagging is enabled, the packets appear with 802.1Q headers. If no tagging is
specified, packets appear in the native format.
Packets that are modified because of routing are copied without modification for Rx SPAN; that is,
the original packet is copied. Packets that are modified because of quality of service (QoS)—for
example, modified Differentiated Services Code Point (DSCP)—are copied without modification for
Rx SPAN.
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
About SPAN and RSPAN
55-3