Software Configuration Guide (4.5)
Configuring SPAN
Download this chapter
Configuring SPANConfiguring SPAN
give_us_feedback

Table Of Contents

Configuring SPAN

Understanding How SPAN Works

SPAN Configuration Guidelines

Configuring SPAN from the NMS

Configuring SPAN from the CLI


Configuring SPAN

This chapter describes how to configure the Switched Port Analyzer (SPAN) on the Catalyst 5000, 4000, 2948G, 2926G, and 2926 series switches.

Note   For complete syntax and usage information for the commands used in this chapter, refer to the Command Reference for your switch.

This chapter consists of these sections:

•Understanding How SPAN Works

•SPAN Configuration Guidelines

•Configuring SPAN from the NMS

•Configuring SPAN from the CLI

Understanding How SPAN Works

SPAN selects network traffic for analysis by a Catalyst 5000 series Network Analysis Module, a SwitchProbe device, or other RMON probe. SPAN mirrors traffic from one or more source ports (Ethernet, Fast Ethernet, Token Ring, or Fiber Distributed Data Interface [FDDI]) on the same virtual LAN (VLAN) to a destination port for analysis (see ).

Figure 31-1 Example SPAN Configuration

In , all traffic on Ethernet port 5 (the source port) is mirrored to Ethernet port 10. A network analyzer on Ethernet port 10 receives all network traffic from Ethernet port 5 without being physically attached to it.

SPAN Configuration Guidelines

Follow these guidelines when configuring SPAN:

•If the SPAN destination port is a Token Ring port, then the source port or ports must be Token Ring ports.

•If the SPAN destination port is a Token Ring port, then the source VLAN must be a Token Ring Concentrator Relay Function (TrCRF) VLAN.

•In software releases prior to 4.2, if the SPAN destination port is connected to another device, the port always receives incoming packets for the VLAN it is assigned to but does not participate in spanning tree for that VLAN. To avoid creating spanning-tree loops, assign the SPAN destination port to an unused VLAN.

•In software release 4.2 and later, incoming traffic on the SPAN destination port is disabled by default. You can enable it using the inpkts enable keywords. However, while the port receives traffic for its assigned VLAN, it does not participate in spanning tree for that VLAN. To avoid creating spanning-tree loops with incoming traffic enabled, assign the SPAN destination port to an unused VLAN.

•You cannot disable the reception of incoming packets on the destination SPAN port (using the inpkts disable keywords) on Token Ring SPAN destination ports.

•On the Catalyst 5000 series Gigabit EtherChannel switching module (WS-X5410), both the source and destination SPAN ports must be on the same module.

•When monitoring a VLAN on the Catalyst 5000 series Gigabit EtherChannel switching module (WS-X5410), you must monitor both transmit and receive traffic (both). You cannot monitor only transmit (tx) or only receive (rx) traffic.

•Any traffic between two network nodes on the same network segment attached to a switch port configured as a SPAN source port is not mirrored to the SPAN destination port; only traffic that is switched is mirrored to the SPAN destination port.

Configuring SPAN from the NMS

To configure SPAN from the NMS, refer to the NMS documentation (see the "Using CiscoWorks2000" section).

Configuring SPAN from the CLI

Specify the source ports, the destination port, the direction of the traffic through the source ports that you want to mirror to the destination port, and whether or not the destination port can receive packets.

To configure a SPAN port, perform this task in privileged mode:

Task
Command

Step 1 Configure SPAN source and destination ports.

set span {src_mod/src_ports | src_vlan} dest_mod/dest_port [inpkts {enable | disable}] [rx | tx | both]

Step 2 Verify the SPAN configuration.

show span


Caution   
If the SPAN destination port is connected to another device and reception of incoming packets is enabled (using the inpkts enable keywords), the SPAN destination port receives traffic for whatever VLAN the SPAN destination port belongs to. However, the SPAN destination port does not participate in spanning tree for that VLAN. Therefore, take care to avoid creating network loops with the SPAN destination port. The inpkts keyword is available in supervisor engine software release 4.2 and later. In earlier releases, incoming packets are always received on the SPAN destination port. To avoid creating spanning-tree loops, assign the SPAN destination port to an unused VLAN.

This example shows how to configure SPAN so that both transmit and receive traffic from port 1/1 (the SPAN source) is mirrored on port 2/1 (the SPAN destination): 

Console> (enable) set span 1/1 2/1

Enabled monitoring of Port 1/1 transmit/receive traffic by Port 2/1

Console> (enable) show span

Status          : enabled

Admin Source    : Port 1/1

Oper Source     : Port 1/1

Destination     : Port 2/1

Direction       : transmit/receive

Incoming Packets: disabled

Console> (enable)

This example shows how to set VLAN 522 as the SPAN source and port 2/1 as the SPAN destination: 

Console> (enable) set span 522 2/1

Enabled monitoring of VLAN 522 transmit/receive traffic by Port 2/1

Console> (enable) show span

Status          : enabled

Admin Source    : VLAN 522

Oper Source     : Port 3/1-2

Destination     : Port 2/1

Direction       : transmit/receive

Incoming Packets: disabled

Console> (enable)

This example shows how to set VLAN 522 as the SPAN source and port 3/12 as the SPAN destination. Only transmit traffic is monitored. Normal incoming packets on the SPAN destination port are allowed. 

Console> (enable) set span 522 2/12 tx inpkts enable

SPAN destination port incoming packets enabled.

Enabled monitoring of VLAN 522 transmit traffic by Port 2/12

Console> (enable) show span

Status          : enabled

Admin Source    : VLAN 522

Oper Source     : Port 2/1-2

Destination     : Port 2/12

Direction       : transmit

Incoming Packets: enabled

Console> (enable)


To disable SPAN, perform this task in privileged mode:

Task
Command

Disable SPAN on the switch.

set span disable [dest_mod/dest_port | all]


This example shows how to disable SPAN on the switch: 

Console> (enable) set span disable 2/1

This command will disable your span session.

Do you want to continue (y/n) [n]?y

Disabled port 2/1 to monitor transmit traffic of VLAN 522

Console> (enable)