Destination Interface - Cisco NCS 4200 Series Configuration Manual

Configuring Switched Port Analyzer
Each RSPAN source must have either ports or Vlans as RSPAN sources. On RSPAN destination, the RSPAN
Vlan is monitored and mirrored to the destination physical port connected to the sniffer device.
Figure 1: RSPAN Traffic
RSPAN allows remote monitoring of traffic where the source and destination switches are connected by
L2VPN networks
The RSPAN source is either ports or Vlans as in a traditional RSPAN. However, the SPAN source and
destination devices are connected through a L2 pseudowire associated with the RSPAN Vlan over an MPLS/IP
network. The L2 pseudowire is dedicated for only RSPAN traffic. The mirrored traffic from the source port
or Vlan is carried over the pseudowire associated with the RSPAN Vlan towards the destination side. On the
destination side, a port belonging to the RSPAN Vlan or EVC BD is connected to sniffer device.

Destination Interface

A destination interface, also called a monitor interface, is a switched interface to which SPAN or RSPAN
sends packets for analysis. You can have only one destination interface for SPAN sessions.
An interface configured as a destination interface cannot be configured as a source interface. Specifying a
trunk interface as a SPAN or RSPAN destination interface stops trunking on the interface.
Source Interface
A source interface is an interface monitored for network traffic analysis. An interface configured as a destination
interface cannot be configured as a source interface.
Layer 2 Configuration Guide for Cisco NCS 4200 Series
Destination Interface
11