Vlan Filtering; Destination Port - Cisco Catalyst 3120 Software Manual

Understanding SPAN and RSPAN
•
•
•

VLAN Filtering

When you monitor a trunk port as a source port, by default, all VLANs active on the trunk are monitored.
You can limit SPAN traffic monitoring on trunk source ports to specific VLANs by using VLAN
filtering.
•
•
•
•
•

Destination Port

Each local SPAN session or RSPAN destination session must have a destination port (also called a
monitoring port) that receives a copy of traffic from the source ports or VLANs and sends the SPAN
packets to the user, usually a network analyzer.
A destination port has these characteristics:
•
•
•
•
•
•
•
•
•
Cisco Catalyst Blade Switch 3120 for HP Software Configuration Guide
29-8
If ports are added to or removed from the source VLANs, the traffic on the source VLAN received
by those ports is added to or removed from the sources being monitored.
You cannot use filter VLANs in the same session with VLAN sources.
You can monitor only Ethernet VLANs.
VLAN filtering applies only to trunk ports or to voice VLAN ports.
VLAN filtering applies only to port-based sessions and is not allowed in sessions with VLAN
sources.
When a VLAN filter list is specified, only those VLANs in the list are monitored on trunk ports or
on voice VLAN access ports.
SPAN traffic coming from other port types is not affected by VLAN filtering; that is, all VLANs are
allowed on other ports.
VLAN filtering affects only traffic forwarded to the destination SPAN port and does not affect the
switching of normal traffic.
For a local SPAN session, the destination port must reside on the same switch or switch stack as the
source port. For an RSPAN session, it is located on the switch containing the RSPAN destination
session. There is no destination port on a switch or switch stack running only an RSPAN source
session.
When a port is configured as a SPAN destination port, the configuration overwrites the original port
configuration. When the SPAN destination configuration is removed, the port reverts to its previous
configuration. If a configuration change is made to the port while it is acting as a SPAN destination
port, the change does not take effect until the SPAN destination configuration had been removed.
If the port was in an EtherChannel group, it is removed from the group while it is a destination port.
If it was a routed port, it is no longer a routed port.
It can be any Ethernet physical port.
It cannot be a secure port.
It cannot be a source port.
It cannot be an EtherChannel group or a VLAN.
It can participate in only one SPAN session at a time (a destination port in one SPAN session cannot
be a destination port for a second SPAN session).
When it is active, incoming traffic is disabled. The port does not transmit any traffic except that
required for the SPAN session. Incoming traffic is never learned or forwarded on a destination port.
Chapter 29 Configuring SPAN and RSPAN
OL-12247-01