Span Concepts And Terminology; Span Session; Traffic Types - Cisco Catalyst 2950 Software Configuration Manual

Understanding SPAN
Figure 20-1 Example SPAN Configuration
1
Only traffic that enters or leaves source ports can be monitored by using SPAN.
This release supports only local SPAN, which means the source and destination interfaces must be on
the same switch.
SPAN does not affect the switching of network traffic on source ports; a copy of the packets received or
sent by the source interfaces are sent to the destination interface. However, an oversubscribed SPAN
destination, for example, a 10-Mbps port monitoring a 100-Mbps port, can cause congestion on the
switch. Destination ports do not receive or forward traffic, except that required for the SPAN session.

SPAN Concepts and Terminology

This section describes concepts and terminology associated with SPAN configuration.

SPAN Session

A SPAN session is an association of a destination port with source ports. You can monitor incoming or
outgoing traffic on a series or range of ports.
SPAN sessions do not interfere with the normal operation of the switch.
You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active
unless you enable the destination port and at least one source port. The show monitor session
session_number privileged EXEC command displays the operational status of a SPAN session.
A SPAN session remains inactive after system power-on until the destination port is operational.

Traffic Types

SPAN sessions include these traffic types:
•
Catalyst 2950 Desktop Switch Software Configuration Guide
20-2
1 2 3 4 5 6 7 8 9 10 11 12
6 7
5 8
4 9
3
2
Network analyzer
Receive (Rx) SPAN—The goal of receive (or ingress) SPAN is to monitor as much as possible all
the packets received by the source interface. A copy of each packet received by the source is sent to
the destination port for that SPAN session. You can monitor a series or range of ingress ports in a
SPAN session.
At the destination port, the packets are seen with the 802.1Q tag, but packets from the switch CPU
to the destination port are without the 802.1Q tag.
Port 5 traffic mirrored
on Port 10
11
12
10
Chapter 20 Configuring SPAN
78-11380-04