Overview Of Traffic Mirroring - Cisco 6000 Series Configuration Manual

Configuring Traffic Mirroring
This module describes the configuration of the traffic mirroring feature. Traffic mirroring is sometimes called
port mirroring, or switched port analyzer (SPAN).
•
•
•
•
•
•
•
•

Overview of Traffic Mirroring

Traffic mirroring, which is sometimes called port mirroring, or Switched Port Analyzer (SPAN) is a Cisco
proprietary feature that enables you to monitor network traffic passing in, or out of, a set of ports. You can
then pass this traffic to a destination port on the same router.
Traffic mirroring copies traffic from one or more source ports and sends the copied traffic to one or more
destinations for analysis by a network analyzer or other monitoring device. Traffic mirroring does not affect
the flow of traffic on the source interfaces or sub-interfaces, and allows the mirrored traffic to be sent to a
destination interface or sub-interface.
For example, you need to attach a traffic analyzer to the router if you want to capture Ethernet traffic that is
sent by host A to host B. All other ports see the traffic between hosts A and B.
Interface and Hardware Component Configuration Guide for Cisco NCS 6000 Series Routers, IOS XR Release 6.4.x
Overview of Traffic Mirroring, on page 95
ERSPAN, on page 96
ERPAN with UDF, on page 97
Traffic Mirroring Terminology, on page 97
Characteristics of the Source Port, on page 98
Characteristics of the Monitor Session, on page 98
Characteristics of the Destination Port, on page 98
Configure Traffic Mirroring, on page 99
7
C H A P T E R
95