24-3
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
OL-10101-02
Chapter 24 Configuring SPAN and RSPAN
Understanding SPAN and RSPAN
SPAN and RSPAN Concepts and Terminology
This section describes concepts and terminology associated with SPAN and RSPAN configuration.

SPAN Session

A local SPAN session is an association of a destination port with source ports. You can monitor incoming
or outgoing traffic on a series or range of ports.
An RSPAN session is an association of source ports across your network with an RSPAN VLAN. The
destination source is the RSPAN VLAN.
SPAN sessions do not interfere with the normal operation of the switch. However, an oversubscribed
SPAN destination, for example, a 10-Mbps port monitoring a 100-Mbps port, results in dropped or lost
packets.
You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active
unless you enable the destination port and at least one source port for that session. The show monitor
session session_number privileged EXEC command displays the operational status of a SPAN session.
A SPAN session remains inactive after system power-on until the destination port is operational.

Traffic Types

SPAN sessions include these traffic types:
• Receive (Rx) SPAN—The goal of receive (or ingress) SPAN is to monitor as much as possible all
the packets received by the source interface. A copy of each packet received by the source is sent to
the destination port for that SPAN session. You can monitor a series or range of ingress ports in a
SPAN session.
At the destination port, if tagging is enabled, the packets appear with the IEEE 802.1Q header. If no
tagging is specified, packets appear in the native format.
Packets that are modified because of quality of service (QoS)—for example, modified Differentiated
Services Code Point (DSCP)—are copied with modification for Rx SPAN.
• Transmit (Tx) SPAN—The goal of transmit (or egress) SPAN is to monitor as much as possible all
the packets sent by the source interface after all modification and processing is performed by the
switch. A copy of each packet sent by the source is sent to the destination port for that SPAN session.
The copy is provided after the packet is modified. You can monitor a range of egress ports in a SPAN
session.
• For packets that are modified because of QoS, the modified packet might not have the same DSCP
(IP packet) or CoS (non-IP packet) as the SPAN source.
Some features that can cause a packet to be dropped during transmit processing might also affect the
duplicated copy for SPAN. These features include IP standard and extended output ACLs on
multicast packets, and egress QoS policing. In the case of output ACLs, if the SPAN source drops
the packet, the SPAN destination would also drop the packet. If the source port is oversubscribed,
the destination ports will have different dropping behavior.
• Both—In a SPAN session, you can monitor a series or range of ports for both received and sent
packets.