Cisco catalyst 3750 Command Reference Manual page 423

Chapter 2 Catalyst 3750 Switch Cisco IOS Commands
You can set a combined maximum of two local SPAN sessions and RSPAN source sessions. You can
have a total of 66 SPAN and RSPAN sessions on a switch or switch stack.
You can have a maximum of 64 destination ports on a switch stack.
If a 10-Gigabit Ethernet port is configured as a SPAN or RSPAN destination port, the line rate of the
link decreases.
Each session can include multiple ingress or egress source ports or VLANs, but you cannot combine
source ports and source VLANs in a single session. Each session can include multiple destination ports.
When you use VLAN-based SPAN (VSPAN) to analyze network traffic in a VLAN or set of VLANs,
all active ports in the source VLANs become source ports for the SPAN or RSPAN session. Trunk ports
are included as source ports for VSPAN, and only packets with the monitored VLAN ID are sent to the
destination port.
You can monitor traffic on a single port or VLAN or on a series or range of ports or VLANs. You select
a series or range of interfaces or VLANs by using the [, | -] options.
If you specify a series of VLANs or interfaces, you must enter a space before and after the comma. If
you specify a range of VLANs or interfaces, you must enter a space before and after the hyphen (-).
EtherChannel ports cannot be configured as SPAN or RSPAN destination ports. A physical port that is
a member of an EtherChannel group can be used as a destination port, but it cannot participate in the
EtherChannel group while it is as a SPAN destination.
A private-VLAN port cannot be configured as a SPAN destination port.
You can monitor individual ports while they participate in an EtherChannel, or you can monitor the
entire EtherChannel bundle by specifying the port-channel number as the RSPAN source interface.
A port used as a destination port cannot be a SPAN or RSPAN source, nor can a port be a destination
port for more than one session at a time.
You can enable IEEE 802.1x authentication on a port that is a SPAN or RSPAN destination port;
however, IEEE 802.1x authentication is disabled until the port is removed as a SPAN destination. If
IEEE 802.1x authentication is not available on the port, the switch returns an error message. You can
enable IEEE 802.1x authentication on a SPAN or RSPAN source port.
VLAN filtering refers to analyzing network traffic on a selected set of VLANs on trunk source ports. By
default, all VLANs are monitored on trunk source ports. You can use the monitor session
session_number filter vlan vlan-id command to limit SPAN traffic on trunk source ports to only the
specified VLANs.
VLAN monitoring and VLAN filtering are mutually exclusive. If a VLAN is a source, VLAN filtering
cannot be enabled. If VLAN filtering is configured, a VLAN cannot become a source.
If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic
at Layer 2.
Destination ports can be configured to act in these ways:
When you enter monitor session session_number destination interface interface-id with no other
•
keywords, egress encapsulation is untagged, and ingress forwarding is not enabled.
When you enter monitor session session_number destination interface interface-id ingress, egress
•
encapsulation is untagged; ingress encapsulation depends on the keywords that follow—dot1q, isl,
or untagged.
OL-8552-07
Catalyst 3750 Switch Command Reference
monitor session
2-393