Trunk Vlan Filtering; Span Traffic; Span And Rspan Session Limits; Configuring Span - Cisco WS-C4003 - Catalyst 4000 Chassis Switch Software Configuration Manual

SPAN and RSPAN Session Limits

Trunk VLAN Filtering

In software release 6.3(1) and later releases, you can use the filter option to select a set of VLANs in a
trunk used in a SPAN session. Trunk VLAN filtering is the analysis of network traffic on a selected set
of VLANs on trunk source ports. If you specify a set of VLANs with the filter option, the traffic spanned
by the session is limited to the VLANs specified. You can combine trunk VLAN filtering with other
source ports that belong to any of the selected VLANs, and you can also use trunk VLAN filtering for
RSPAN. Based on the traffic type (ingress, egress, or both), SPAN sends a copy of the network traffic in
the selected VLANs to the destination port.
Use trunk VLAN filtering only with trunk source ports. If you combine trunk VLAN filtering with other
source ports that belong to VLANs not included in the selected list of filter VLANs, SPAN includes only
the ports that belong to one or more of the selected VLANs in the operational sources.
When a VLAN is cleared, it is removed from the VLAN filter list. A SPAN session is disabled if the
VLAN filter list becomes empty.
Trunk VLAN filtering is not applicable to VSPAN sessions.
Trunk VLAN filtering is available for local SPAN sessions and RSPAN sessions.

SPAN Traffic

All network traffic, including multicast and bridge protocol data unit (BPDU) packets, can be monitored
using SPAN (RSPAN does not support monitoring of BPDU packets).
SPAN and RSPAN Session Limits
You can configure (and store in NVRAM) up to five SPAN sessions in a Catalyst 4000 family switch:
the five sessions can be split any way between SPAN, RSPAN source, and RSPAN destination sessions.

Configuring SPAN

The following sections describe how to configure SPAN.

Understanding How SPAN Works

SPAN selects network traffic for analysis by a Switch Probe device or other RMON probe. SPAN mirrors
traffic from one or more source ports (Ethernet, Fast Ethernet, or Gigabit Ethernet) on one or more
VLANs to a destination port for analysis (see
(the source port) is mirrored to Ethernet port 10. A network analyzer on Ethernet port 10 receives all
network traffic from Ethernet port 5 without being physically attached to it.
Software Configuration Guide—Catalyst 4000 Family, Catalyst 2948G, Catalyst 2980G, Releases 6.3 and 6.4
25-4
Chapter 25
Figure 25-1). In Figure 25-1, all traffic on Ethernet port 5
Configuring SPAN and RSPAN
78-12647-02