CHAPTE R
29-1
Cisco Catalyst Blade Switch 3130 for Dell Software Configuration Guide
OL-13270-01
29
Configuring SPAN and RSPAN
This chapter describes how to configure Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN)
on the switch. Unless otherwise noted, the term switch refers to a standalon e switch and to a switch st ack.
Note For complete syntax and usage information for the commands used in this chapter, see the command
reference for this release.
This chapter consists of these sections:
Understanding SPAN and RSPAN, page29-1
Configuring SPAN and RSPAN, page29-10
Displaying SPAN and RSPAN Status, page29-23

Understanding SPAN and RSPAN

You can analyze network traffic passing through ports or VLANs by using SPAN or RSPAN to send a
copy of the traffic to another port on the switch or on another swi tch that has been connected to a network
analyzer or other monitoring or security device. SPAN copies (or mirrors) traffic received or sent (or
both) on source ports or source VLANs to a destination port for a na lysis. SPAN does not affect the
switching of network traffic on the source ports or VLANs. You must dedicate the destination port for
SPAN use. Except for traffic that is required for the SPAN or RSPAN session, destination ports do not
receive or forward traffic.
Only traffic that enters or leaves source ports or traffic that enters or leaves source VLANs can be
monitored by using SPAN; traffic routed to a source VLAN cannot be monitored. For example, if
incoming traffic is being monitored, traffic that gets routed from another VLAN to the source VLAN
cannot be monitored; however, traffic that is received on the source VLAN and routed to another VLAN
can be monitored.
You can use the SPAN or RSPAN destination port to inject traffic from a network security device. For
example, if you connect a Cisco Intrusion Detection System (IDS) sensor a ppliance to a destination port,
the IDS device can send TCP reset packets to close down the TCP session of a suspected attacker.