51-10
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 51 Configuring SPAN and RSPAN
CPU Port Sniffing

Configuration Scenario

This example shows how to use the commands described in this chapter to completely configure and
unconfigure a span session. Assume that you want to monitor bidirectional traffic from source interfaces
Fast Ethernet 4/10, 4/11 and 4/12, Interface 4/10 is configured as a trunk interface carrying VLANs 1
through 4094. Interface Fast Ethernet 4/11 is configured as an access port in VLAN 57 and interface Fast
Ethernet 4/12 is configured as an access port in VLAN 58. You want to monitor only traffic in VLAN
57 in that session. Using Fast Ethernet 4/15 as your destination interface, you would enter the following
commands:
Switch(config)# monitor session 1 source interface fastethernet 4/10 - 12
Switch(config)# monitor session 1 filter vlan 57
Switch(config)# monitor session 1 destination interface fastethernet 4/15
You are now monitoring traffic from interface Fast Ethernet 4/10 that is on VLAN 57 out of interface
FastEthernet 4/15. To disable the span session enter the following command:
Switch(config)# no monitor session 1

Verifying a SPAN Configuration

This example shows how to verify the configuration of SPAN session 2:
Switch# show monitor session 2
Session 2
---------
Source Ports:
RX Only: Fa5/12
TX Only: None
Both: None
Source VLANs:
RX Only: None
TX Only: None
Both: None
Destination Ports: Fa5/45
Filter VLANs: 1-5,9
Switch#
CPU Port Sniffing
When configuring a SPAN session, you can specify the CPU (or a subset of CPU queues) as a SPAN
source. Queues may be specified either by number or by name. When such a source is specified, traffic
going to the CPU through one of the specified queues is mirrored and sent out of the SPAN destination
port in the session. This traffic includes both control packets and regular data packets that are sent to or
from the CPU (due to software forwarding).
You can mix the CPU source with either regular port sources or VLAN sources.