Monitored Traffic - Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Software Configuration Manual

Understanding How Local SPAN, RSPAN, and ERSPAN Work
The ERSPAN source session copies traffic from the source ports or source VLANs and forwards the
traffic using routable GRE-encapsulated packets to the ERSPAN destination session. The ERSPAN
destination session switches the traffic to the destination ports.
Figure 48-3
Routed
GRE-encapsulated
traffic

Monitored Traffic

These sections describe the traffic that local SPAN, RSPAN, and ERSPAN can monitor:
•
•
•
Monitored Traffic Direction
You can configure local SPAN sessions, RSPAN source sessions, and ERSPAN source sessions to
monitor ingress traffic (called ingress SPAN), or to monitor egress traffic (called egress SPAN), or to
monitor traffic flowing in both directions.
Ingress SPAN copies traffic received by the source ports and VLANs for analysis at the destination port.
Egress SPAN copies traffic transmitted from the source ports and VLANs. When you enter the both
keyword, SPAN copies the traffic received and transmitted by the source ports and VLANs to the
destination port.
Monitored Traffic
By default, local SPAN and ERSPAN monitor all traffic, including multicast and bridge protocol data
unit (BPDU) frames. RSPAN does not support BPDU monitoring.
Duplicate Traffic
In some configurations, SPAN sends multiple copies of the same source traffic to the destination port.
For example, in a configuration with a bidirectional SPAN session (both ingress and egress) for two
SPAN sources, called s1 and s2, to a SPAN destination port, called d1, if a packet enters the switch
through s1 and is sent for egress from the switch to s2, ingress SPAN at s1 sends a copy of the packet to
SPAN destination d1 and egress SPAN at s2 sends a copy of the packet to SPAN destination d1. If the
Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY
48-4
ERSPAN Configuration
Switch D
Routed
GRE-encapsulated
traffic
Routed
Network
A3
Switch A
A1 A2
Monitored Traffic Direction, page 48-4
Monitored Traffic, page 48-4
Duplicate Traffic, page 48-4
Chapter 48
D1
D2
Probe
Routed
GRE-encapsulated
traffic
B4
Switch B
B1 B2 B3
Configuring Local SPAN, RSPAN, and ERSPAN
Destination switch
(data center)
Source switch(es)
(access)
OL-11439-03