30-2
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 30 Configuring SPAN and RSPAN
Information About SPAN and RSPAN
SPAN copies (or mirrors) traffic received or sent (or both) on source ports or source VLANs to a
destination port for analysis. SPAN does not affect the switching of network traffic on the source por ts
or VLANs. You must dedicate the destination port for SPAN use. Except for traffic that is required for
the SPAN or RSPAN session, destination ports do not receive or forward traffic.
Only traffic that enters or leaves source ports or traffic that enters or leaves source VLANs can be
monitored by using SPAN; traffic routed to a source VLAN cannot be monitored. For example, if
incoming traffic is being monitored, traffic that gets routed from another VLAN to the source VLAN
cannot be monitored; however, traffic that is received on the source VLAN and routed to another VLAN
can be monitored.
You can use the SPAN or RSPAN destination port to inject traffic from a network security device. For
example, if you connect a Cisco Intrusion Detection System (IDS) sensor appli ance to a destination port,
the IDS device can send TCP reset packets to close down the TCP session of a suspected attacker.
Local SPAN
Local SPAN supports a SPAN session entirely within one switch; all source ports or source VLANs and
destination ports are in the same switch. Local SPAN copies traffic from one or more source ports in any
VLAN or from one or more VLANs to a destination port for analysis. For example, in Figure 30-1, all
traffic on port 5 (the source port) is mirrored to port 10 (the destination port). A network analyzer on
port 10 receives all network traffic from port 5 without being physically attached to port 5.
Figure 30-1 Example of Local SPAN Configuration on a Single Switch
Remote SPAN
RSPAN supports source ports, source VLANs, and destination ports on different switches, enabling
remote monitoring of multiple switches across your network. Figure 30-2 shows source ports on Switch
A and Switch B. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that
is dedicated for that RSPAN session in all participating switches. The RSPAN traffic from the source
ports or VLANs is copied into the RSPAN VLAN and forwarded over trunk ports carry ing the RSPAN
VLAN to a destination session monitoring the RSPAN VLAN. Each RSPAN source switch must have
either ports or VLANs as RSPAN sources. The destination is always a physical port, as shown on Switch
C in the figure.
1 2 3 4 5 6 7 8 9 10 11 12
Port 5 traffic mirrored
on Port 10
3
2
1
4
567
8
9
11
12
10
Network analyzer
43580