21-3
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 21 Configuring SPAN and RSPAN Understanding SPAN and RSPAN

SPAN and RSPAN Concepts and Terminology

This secti on descri bes conce pts and te rminology associate d with SPAN and RSPAN co nfiguration.

SPAN Session

A local SPAN session is an association of a destination port with source ports and source VLANs. An
RSPAN session is an association of source ports and source VLANs across your network with an RSPAN
VLAN. The destination source is the RSPAN VLAN.
You configure SPAN sessions by using parameters that specify the source of network traffic to monitor.
Traffic monitoring in a SPAN session has these restrictions:
•You can mon itor in coming traffic on a series or range of por ts and VLA Ns.
•You can monitor outgoing traffic on a single port; you cannot monitor outgoing traffic on multiple
ports.
•You ca nno t m onit or outg oing t raffic on VLA Ns.
You ca n co nfigure two sepa rat e SPAN o r R SPAN se ssions wi th sepa rat e or overlapping set s o f SPAN
source por ts and VLANs. Bot h switche d and routed po rts can be configur ed as SPAN sources an d
destinations.
SPAN sessions do not interfere wit h the normal operati on of the switch . However, an oversubscri bed
SPAN destina ti on, for example , a 10-M bps port mo nitori ng a 100-M bps po rt, resul ts i n dro pped or lost
packets.
You can co nfigure SPAN sessions on di sabled port s; however, a SPAN session doe s not become act ive
unless you enable t he desti nat ion por t and at least one sour ce por t or VLAN for th at sessi on . The show
monitor session session_number privileged EXEC command displays the operational status of a SPAN
session.
A SPAN session remains inactive after system power-on until the destination port is operational.

Traffic Types

SPAN sessions include these traffic types:
•Rece ive (Rx) SPAN —The goal of receive (or ingress) SPAN is to monitor as much as possible all
the packets rec eived by the source int erface or VLAN before any modifica tion or proc essing is
perfor med b y the swi tch. A cop y of each pa cket recei v ed by th e source is s ent to the des tinatio n port
for th at SPA N se ssion. You can mo nitor a seri es o r r ange of i n gress por ts or VLAN s in a SPAN
session.
On tagged packets (Inter-Switch Link [ISL] or IEEE 802.1Q), the tagging is removed at the ingress
port. At the destination port, if tagging is enabled, the packets appear with the ISL or 802.1Q
header s. If no taggi ng is speci fied, packets ap pear in the native format.
Packets that are modified because of routing are copied without modification for Rx SPAN; that is,
the original packet is copied. Pa ckets that are modified because of quality of service (QoS)—for
example, modified Differentiated Services Code Point (DSCP)—are copied with modification for Rx
SPAN.
Some fe atu re s tha t c an ca use a p acket t o be d rop ped d uri n g r eceive processi ng have no effect on
SPA N; t he d est ina tion por t re c eives a copy of the pa cket even if the ac tual in co ming pa cket i s
dropped. These feat ures incl ude IP stan dard an d extended inpu t access contr ol lists (ACLs), IP