Span Sessions - Cisco Catalyst 2960 series Configuration Manual

SPAN Sessions

SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs,
and send the monitored traffic to one or more destination ports.
A local SPAN session is an association of a destination port with source ports or source VLANs, all on a
single network device. Local SPAN does not have separate source and destination sessions. Local SPAN
sessions gather a set of ingress and egress packets specified by the user and form them into a stream of SPAN
data, which is directed to the destination port.
RSPAN consists of at least one RSPAN source session, an RSPAN VLAN, and at least one RSPAN destination
session. You separately configure RSPAN source sessions and RSPAN destination sessions on different
network devices. To configure an RSPAN source session on a device, you associate a set of source ports or
source VLANs with an RSPAN VLAN. The output of this session is the stream of SPAN packets that are
sent to the RSPAN VLAN. To configure an RSPAN destination session on another device, you associate the
destination port with the RSPAN VLAN. The destination session collects all RSPAN VLAN traffic and sends
it out the RSPAN destination port.
An RSPAN source session is very similar to a local SPAN session, except for where the packet stream is
directed. In an RSPAN source session, SPAN packets are relabeled with the RSPAN VLAN ID and directed
over normal trunk ports to the destination switch.
An RSPAN destination session takes all packets received on the RSPAN VLAN, strips off the VLAN tagging,
and presents them on the destination port. The session presents a copy of all RSPAN VLAN packets (except
Layer 2 control packets) to the user for analysis.
More than one source session and more than one destination session can be active in the same RSPAN VLAN.
Intermediate switches also can separate the RSPAN source and destination sessions. These switches are unable
to run RSPAN, but they must respond to the requirements of the RSPAN VLAN.
Traffic monitoring in a SPAN session has these restrictions:
• Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same session.
• You can run both a local SPAN and an RSPAN source session in the same switch or switch stack. The
switch or switch stack supports a total of 64 source and RSPAN destination sessions.
• You can configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of
SPAN source ports and VLANs. Both switched and routed ports can be configured as SPAN sources
and destinations.
• You can have multiple destination ports in a SPAN session, but no more than 64 destination ports per
switch stack.
• SPAN sessions do not interfere with the normal operation of the switch. However, an oversubscribed
SPAN destination, for example, a 10-Mb/s port monitoring a 100-Mb/s port, can result in dropped or
lost packets.
• When SPAN or RSPAN is enabled, each packet being monitored is sent twice, once as normal traffic
and once as a monitored packet. Therefore monitoring a large number of ports or VLANs could potentially
generate large amounts of network traffic.
• You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active
unless you enable the destination port and at least one source port or VLAN for that session.
• The switch does not support a combination of local SPAN and RSPAN in a single session.
◦ An RSPAN source session cannot have a local destination port.
◦ An RSPAN destination session cannot have a local source port.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
Information About SPAN and RSPAN
477