Monitoring Switch Traffic 413
disabling of spanning tree on a destination port means that administrators
must only connect the destination port to directly attached probes to avoid
the possibility of a network loop.
• GVRP is disabled on destination ports such that GVRP PDUs are never
received from or transmitted to the port. Dynamic registrations are not
allowed on a destination port. The GVRP configuration at the port is
maintained and is reapplied when the port is no longer part of the SPAN.
• All static filters, both source and destination, are disabled on destination
ports.
• If routing is enabled on a destination port or an RSPAN VLAN, all route
entries associated with that port are purged. From a routing perspective,
the interface is marked as down.
• Generally, the configuration of the source port is undisturbed so that its
behavior remains the same as if it was not mirrored.
• Packets locally generated by the switch and transmitted over a source port
are not copied in a mirroring session.
• The internal CPU port is allowed as a source port for local monitoring
sessions only (not allowed for RSPAN). If the internal CPU port is
mirrored, packets received and generated by the CPU for all ports are
mirrored.
Remote Capture
The Remote Capture feature enables mirrorring packets transmitted and
received by the switch CPU to a remote client for packet analysis using the
Wireshark tool. This feature can be used to help diagnose switch behavior or
monitor traffic sent to the switch CPU. The capture feature can also be
configured to capture to a local file or to an in-memory buffer.
Why is Traffic Monitoring Needed?
Monitoring the traffic that the switch handles, as well as monitoring all traffic
in the network, can help provide information about network performance and
utilization. This information can be useful in network planning and resource
allocation. Information about traffic flows can also help troubleshoot
problems in the network.