20-3
Catalyst 2940 Switch Software Configuration Guide
78-15507-02
Chapter20 Configuring SPAN Understanding SPAN
Traffic Types
SPAN sessions include these traffic types:
•Receive (Rx) SPAN—The goal of receive (or ingress) SPAN is to monitor as much as possible all
the packets received by the source interface. A copy of each packet received by the source is sent to
the destination port for that SPAN session. You can monitor a series or range of ingress ports in a
SPAN session.
At the destination port, if tagging is enabled, the packets appea r with the 802.1Q heade r. I f no
tagging is specified, packets appear in the native format.
Packets that are modified because of quality of service (QoS) are copied with modification for Rx
SPAN.
•Transmit (Tx) SPAN—The goal of transmit (or egress) SPAN is to monitor as much as possible all
the packets sent by the source interface after all modification and processing is performed by the
switch. A copy of each packet sent by the source is sent to the destination port for that SP AN ses sion.
The copy is provided after the packet is modified. You can monitor a range of egress ports in a SPAN
session.
For packets that are modified because of QoS, the modified packet might not have the same CoS
(non-IP packet) as the SPAN source.
Some features that can cause a packet to be dropped during transmit processing might also affect the
duplicated copy for SPAN. If the source port is oversubscribed, the destination ports will have
different dropping behavior.
•Both—In a SPAN session, you can monitor a series or range of ports for both received and se nt
packets.
Source Port
A source port (also called a monitored port) is a switched port that you monitor for network traffic
analysis. In a single local SPAN session, you can monitor source port traffic such as received (Rx),
transmitted (Tx), or bidirectional (both). The switch supports any num be r of sour ce por ts (u p t o t he
maximum number of available ports on the switch).
A source port has these characteristics:
•It can be any port type (for example, EtherChannel, Fast Ether net, G igab it Eth er net, and so fo rth) .
•It cannot be a destination port.
•Each source port can be configured with a direction (ingr ess, egr ess, o r both) t o mo ni tor. For
EtherChannel sources, the monitored direction would apply to al l the p hysi cal p ort s in the group.
•Source ports can be in the same or different VLANs.
You can configure a trunk port as a source port. All VLANs active on the trunk are monitored.
Destination Port
Each local SPAN session destination session must have a destin ation port (also c alled a monitoring port)
that receives a copy of traffic from the source port.
The destination port has these characteristics:
•It must reside on the same switch as the source port (for a local SPAN session).
•It can be any Ethernet physical port.