Destination Port; Source Port - Cisco WS-C2948G-GE-TX Configuration Manual

Understanding How SPAN and RSPAN Work
After the system is on, a SPAN or RSPAN destination session remains inactive until the destination port
is operational. An RSPAN source session remains inactive until any of the source ports are operational
or the RSPAN VLAN becomes active.

Destination Port

A destination port (also called a monitor port) is a switch port where SPAN sends packets for analysis.
After a port becomes an active destination port, it does not forward any traffic except that required for
the SPAN session. By default, an active destination port disables incoming traffic (from the network to
the switching bus), unless you specifically enable the port. If incoming traffic is enabled for the
destination port, it is switched in the native VLAN of the destination port. The destination port does not
participate in spanning tree while the SPAN session is active. See the caution statement in the
"Configuring SPAN" section on page 26-6
topology.
Only one destination port is allowed per SPAN session, and the same port cannot be a destination port
for multiple SPAN sessions. A switch port that is configured as a destination port cannot be configured
as a source port or a reflector port. EtherChannel ports cannot be SPAN destination ports.
If the trunking mode of a SPAN destination port is "on" or "nonegotiate" during SPAN session
configuration, the SPAN packets that are forwarded by the destination port have the encapsulation that
is specified by the trunk type; however, the destination port stops trunking. The show trunk command
reflects the trunking status for the port prior to SPAN session configuration.

Source Port

A source port is a switch port that is monitored for network traffic analysis. The traffic through the source
ports can be categorized as ingress, egress, or both. You can monitor one or more source ports in a single
SPAN session with user-specified traffic types (ingress, egress, or both) that are applicable for all the
source ports.
You can configure source ports in any VLAN. You can configure VLANs as source ports (src_vlans),
which means that all ports in the specified VLANs are source ports for the SPAN session.
Source ports are administrative (Admin Source) or operational (Oper Source) or both. Administrative
source ports are the source ports or source VLANs that are specified during SPAN session configuration.
Operational source ports are the source ports that are monitored by the destination port. For example,
when source VLANs are used as the administrative source, the operational source is all the ports in all
the specified VLANs.
The operational sources are always active ports. If a port is not in the spanning tree, it is not an
operational source. All physical ports in an EtherChannel source are included in operational sources if
the logical port is included in the spanning tree.
The destination port and reflector port, if they belong to any of the administrative source VLANs, are
excluded from the operational source.
You can configure a port as a source port in multiple active SPAN sessions, but you cannot configure an
active source port as a destination port or reflector port for any SPAN session.
If a SPAN session is inactive, the "oper source" field does not update until the session becomes active.
You can configure trunk ports as source ports and mix them with nontrunk source ports; however, the
trunk settings of the destination port during the SPAN session configuration determine the encapsulation
of the packets that are forwarded by the destination port.
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
26-2
Chapter 26
for information on how to prevent loops in your network
Configuring SPAN and RSPAN
78-15908-01