Configuring SPAN and RSPAN

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http:/​/​www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for SPAN and RSPAN

SPAN

  • You can limit SPAN traffic to specific VLANs by using the filter vlan keyword. If a trunk port is being monitored, only traffic on the VLANs specified with this keyword is monitored. By default, all VLANs are monitored on a trunk port.

RSPAN

  • We recommend that you configure an RSPAN VLAN before you configure an RSPAN source or a destination session.

Restrictions for SPAN and RSPAN

SPAN

The restrictions for SPAN are as follows:

  • On each switch, you can configure 66 sessions. A maximum of source sessions can be configured and the remaining sessions can be configured as RSPAN destinations sessions. A source session is either a local SPAN session or an RSPAN source session.

  • For SPAN sources, you can monitor traffic for a single port or VLAN or a series or range of ports or VLANs for each session. You cannot mix source ports and source VLANs within a single SPAN session.

  • The destination port cannot be a source port; a source port cannot be a destination port.

  • You cannot have two SPAN sessions using the same destination port.

  • When you configure a switch port as a SPAN destination port, it is no longer a normal switch port; only monitored traffic passes through the SPAN destination port.

  • Entering SPAN configuration commands does not remove previously configured SPAN parameters. You must enter the no monitor session {session_number | all | local | remote} global configuration command to delete configured SPAN parameters.

  • For local SPAN, outgoing packets through the SPAN destination port carry the original encapsulation headers—untagged, ISL, or IEEE 802.1Q—if the encapsulation replicate keywords are specified. If the keywords are not specified, the packets are sent in native form.

  • You can configure a disabled port to be a source or destination port, but the SPAN function does not start until the destination port and at least one source port or source VLAN are enabled.

  • You cannot mix source VLANs and filter VLANs within a single SPAN session.

Traffic monitoring in a SPAN session has the following restrictions:

  • Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same session.

  • Wireshark does not capture egress packets when egress span is active.

  • The switch supports up to four local SPAN or RSPAN source sessions. However if this switch is stacked with Catalyst 2960-S switches, you are limited to 2 local SPAN or RSPAN source sessions.

  • You can run both a local SPAN and an RSPAN source session in the same switch or switch stack. The switch or switch stack supports a total of 66 source and RSPAN destination sessions.

  • You can configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of SPAN source ports and VLANs. Both switched and routed ports can be configured as SPAN sources and destinations.

  • You can have multiple destination ports in a SPAN session, but no more than 64 destination ports per switch stack.

  • SPAN sessions do not interfere with the normal operation of the switch. However, an oversubscribed SPAN destination, for example, a 10-Mb/s port monitoring a 100-Mb/s port, can result in dropped or lost packets.

  • When SPAN or RSPAN is enabled, each packet being monitored is sent twice, once as normal traffic and once as a monitored packet. Monitoring a large number of ports or VLANs could potentially generate large amounts of network traffic.

  • You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active unless you enable the destination port and at least one source port or VLAN for that session.

  • The switch does not support a combination of local SPAN and RSPAN in a single session.

    • An RSPAN source session cannot have a local destination port.

    • An RSPAN destination session cannot have a local source port.

    • An RSPAN destination session and an RSPAN source session that are using the same RSPAN VLAN cannot run on the same switch or switch stack.

RSPAN

The restrictions for RSPAN are as follows:

  • RSPAN does not support BPDU packet monitoring or other Layer 2 switch protocols.

  • The RSPAN VLAN is configured only on trunk ports and not on access ports. To avoid unwanted traffic in RSPAN VLANs, make sure that the VLAN remote-span feature is supported in all the participating switches.

  • RSPAN VLANs are included as sources for port-based RSPAN sessions when source trunk ports have active RSPAN VLANs. RSPAN VLANs can also be sources in SPAN sessions. However, since the switch does not monitor spanned traffic, it does not support egress spanning of packets on any RSPAN VLAN identified as the destination of an RSPAN source session on the switch.

  • If you enable VTP and VTP pruning, RSPAN traffic is pruned in the trunks to prevent the unwanted flooding of RSPAN traffic across the network for VLAN IDs that are lower than 1005.

  • To use RSPAN, the switch must be running the LAN Base image.

Information About SPAN and RSPAN

SPAN and RSPAN

You can analyze network traffic passing through ports or VLANs by using SPAN or RSPAN to send a copy of the traffic to another port on the switch or on another switch that has been connected to a network analyzer or other monitoring or security device. SPAN copies (or mirrors) traffic received or sent (or both) on source ports or source VLANs to a destination port for analysis. SPAN does not affect the switching of network traffic on the source ports or VLANs. You must dedicate the destination port for SPAN use. Except for traffic that is required for the SPAN or RSPAN session, destination ports do not receive or forward traffic.

Only traffic that enters or leaves source ports or traffic that enters or leaves source VLANs can be monitored by using SPAN; traffic routed to a source VLAN cannot be monitored. For example, if incoming traffic is being monitored, traffic that gets routed from another VLAN to the source VLAN cannot be monitored; however, traffic that is received on the source VLAN and routed to another VLAN can be monitored.

You can use the SPAN or RSPAN destination port to inject traffic from a network security device. For example, if you connect a Cisco Intrusion Detection System (IDS) sensor appliance to a destination port, the IDS device can send TCP reset packets to close down the TCP session of a suspected attacker.

Local SPAN

Local SPAN supports a SPAN session entirely within one switch; all source ports or source VLANs and destination ports are in the same switch or switch stack. Local SPAN copies traffic from one or more source ports in any VLAN or from one or more VLANs to a destination port for analysis.

Figure 1. Example of Local SPAN Configuration on a Single Device. All traffic on port 5 (the source port) is mirrored to port 10 (the destination port). A network analyzer on port 10 receives all network traffic from port 5 without being physically attached to port 5.

Figure 2. Example of Local SPAN Configuration on a Device Stack.

This is an example of a local SPAN in a switch stack, where the source and destination ports reside on different stack members.



Related Tasks
Creating a Local SPAN Session
Creating a Local SPAN Session and Configuring Incoming Traffic
Related References
Example: Configuring Local SPAN

Remote SPAN

RSPAN supports source ports, source VLANs, and destination ports on different switches (or different switch stacks), enabling remote monitoring of multiple switches across your network.

Figure 3. Example of RSPAN Configuration. The figure below shows source ports on Switch A and Switch B. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches. The RSPAN traffic from the source ports or VLANs is copied into the RSPAN VLAN and forwarded over trunk ports carrying the RSPAN VLAN to a destination session monitoring the RSPAN VLAN. Each RSPAN source switch must have either ports or VLANs as RSPAN sources. The destination is always a physical port, as shown on Switch C in the figure.

Related Tasks
Creating an RSPAN Source Session
Creating an RSPAN Destination Session
Creating an RSPAN Destination Session and Configuring Incoming Traffic
Related References
Examples: Creating an RSPAN VLAN

SPAN and RSPAN Concepts and Terminology

SPAN Sessions

SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports.

A local SPAN session is an association of a destination port with source ports or source VLANs, all on a single network device. Local SPAN does not have separate source and destination sessions. Local SPAN sessions gather a set of ingress and egress packets specified by the user and form them into a stream of SPAN data, which is directed to the destination port.

RSPAN consists of at least one RSPAN source session, an RSPAN VLAN, and at least one RSPAN destination session. You separately configure RSPAN source sessions and RSPAN destination sessions on different network devices. To configure an RSPAN source session on a device, you associate a set of source ports or source VLANs with an RSPAN VLAN. The output of this session is the stream of SPAN packets that are sent to the RSPAN VLAN. To configure an RSPAN destination session on another device, you associate the destination port with the RSPAN VLAN. The destination session collects all RSPAN VLAN traffic and sends it out the RSPAN destination port.

An RSPAN source session is very similar to a local SPAN session, except for where the packet stream is directed. In an RSPAN source session, SPAN packets are relabeled with the RSPAN VLAN ID and directed over normal trunk ports to the destination switch.

An RSPAN destination session takes all packets received on the RSPAN VLAN, strips off the VLAN tagging, and presents them on the destination port. The session presents a copy of all RSPAN VLAN packets (except Layer 2 control packets) to the user for analysis.

More than one source session and more than one destination session can be active in the same RSPAN VLAN. Intermediate switches also can separate the RSPAN source and destination sessions. These switches are unable to run RSPAN, but they must respond to the requirements of the RSPAN VLAN.

Traffic monitoring in a SPAN session has these restrictions:

  • Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same session.

  • You can run both a local SPAN and an RSPAN source session in the same switch or switch stack. The switch or switch stack supports a total of 66 source and RSPAN destination sessions.

  • You can configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of SPAN source ports and VLANs. Both switched and routed ports can be configured as SPAN sources and destinations.

  • You can have multiple destination ports in a SPAN session, but no more than 64 destination ports per switch stack.

  • SPAN sessions do not interfere with the normal operation of the switch. However, an oversubscribed SPAN destination, for example, a 10-Mb/s port monitoring a 100-Mb/s port, can result in dropped or lost packets.

  • When SPAN or RSPAN is enabled, each packet being monitored is sent twice, once as normal traffic and once as a monitored packet. Therefore monitoring a large number of ports or VLANs could potentially generate large amounts of network traffic.

  • You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active unless you enable the destination port and at least one source port or VLAN for that session.

  • The switch does not support a combination of local SPAN and RSPAN in a single session.

    • An RSPAN source session cannot have a local destination port.

    • An RSPAN destination session cannot have a local source port.

    • An RSPAN destination session and an RSPAN source session that are using the same RSPAN VLAN cannot run on the same switch or switch stack.

Related Tasks
Creating a Local SPAN Session
Creating a Local SPAN Session and Configuring Incoming Traffic
Related References
Example: Configuring Local SPAN

Monitored Traffic

SPAN sessions can monitor these traffic types:

  • Receive (Rx) SPAN—Receive (or ingress) SPAN monitors as much as possible all of the packets received by the source interface or VLAN before any modification or processing is performed by the switch. A copy of each packet received by the source is sent to the destination port for that SPAN session.

    Packets that are modified because of routing or Quality of Service (QoS)—for example, modified Differentiated Services Code Point (DSCP)—are copied before modification.

    Features that can cause a packet to be dropped during receive processing have no effect on ingress SPAN; the destination port receives a copy of the packet even if the actual incoming packet is dropped. These features include IP standard and extended input Access Control Lists (ACLs), ingress QoS policing, VLAN ACLs, and egress QoS policing.

  • Transmit (Tx) SPAN—Transmit (or egress) SPAN monitors as much as possible all of the packets sent by the source interface after all modification and processing is performed by the switch. A copy of each packet sent by the source is sent to the destination port for that SPAN session. The copy is provided after the packet is modified.

    Packets that are modified because of routing (for example, with modified time-to-live (TTL), MAC address, or QoS values) are duplicated (with the modifications) at the destination port.

    Features that can cause a packet to be dropped during transmit processing also affect the duplicated copy for SPAN. These features include IP standard and extended output ACLs and egress QoS policing.

  • Both—In a SPAN session, you can also monitor a port or VLAN for both received and sent packets. This is the default.

The default configuration for local SPAN session ports is to send all packets untagged. SPAN also does not normally monitor bridge protocol data unit (BPDU) packets and Layer 2 protocols, such as Cisco Discovery Protocol (CDP), VLAN Trunk Protocol (VTP), Dynamic Trunking Protocol (DTP), Spanning Tree Protocol (STP), and Port Aggregation Protocol (PAgP). However, when you enter the encapsulation replicate keywords when configuring a destination port, these changes occur:

  • Packets are sent on the destination port with the same encapsulation (untagged or IEEE 802.1Q) that they had on the source port.

  • Packets of all types, including BPDU and Layer 2 protocol packets, are monitored.

Therefore, a local SPAN session with encapsulation replicate enabled can have a mixture of untagged and IEEE 802.1Q tagged packets appear on the destination port.

Switch congestion can cause packets to be dropped at ingress source ports, egress source ports, or SPAN destination ports. In general, these characteristics are independent of one another. For example:

  • A packet might be forwarded normally but dropped from monitoring due to an oversubscribed SPAN destination port.

  • An ingress packet might be dropped from normal forwarding, but still appear on the SPAN destination port.

  • An egress packet dropped because of switch congestion is also dropped from egress SPAN.

In some SPAN configurations, multiple copies of the same source packet are sent to the SPAN destination port. For example, a bidirectional (both Rx and Tx) SPAN session is configured for the Rx monitor on port A and Tx monitor on port B. If a packet enters the switch through port A and is switched to port B, both incoming and outgoing packets are sent to the destination port. Both packets are the same unless a Layer 3 rewrite occurs, in which case the packets are different because of the packet modification.

Source Ports

A source port (also called a monitored port) is a switched or routed port that you monitor for network traffic analysis.

In a local SPAN session or RSPAN source session, you can monitor source ports or VLANs for traffic in one or both directions.

The switch supports any number of source ports (up to the maximum number of available ports on the switch) and any number of source VLANs (up to the maximum number of VLANs supported).

However, the switch supports a maximum of four sessions (two sessions if switch is in a stack with Catalyst 2960-S switches) (local or RSPAN) with source ports or VLANs. You cannot mix ports and VLANs in a single session.

A source port has these characteristics:

  • It can be monitored in multiple SPAN sessions.

  • Each source port can be configured with a direction (ingress, egress, or both) to monitor.

  • It can be any port type (for example, EtherChannel, Gigabit Ethernet, and so forth).

  • For EtherChannel sources, you can monitor traffic for the entire EtherChannel or individually on a physical port as it participates in the port channel.

  • It can be an access port, trunk port, routed port, or voice VLAN port.

  • It cannot be a destination port.

  • Source ports can be in the same or different VLANs.

  • You can monitor multiple source ports in a single session.

Source VLANs

VLAN-based SPAN (VSPAN) is the monitoring of the network traffic in one or more VLANs. The SPAN or RSPAN source interface in VSPAN is a VLAN ID, and traffic is monitored on all the ports for that VLAN.

VSPAN has these characteristics:

  • All active ports in the source VLAN are included as source ports and can be monitored in either or both directions.

  • On a given port, only traffic on the monitored VLAN is sent to the destination port.

  • If a destination port belongs to a source VLAN, it is excluded from the source list and is not monitored.

  • If ports are added to or removed from the source VLANs, the traffic on the source VLAN received by those ports is added to or removed from the sources being monitored.

  • You cannot use filter VLANs in the same session with VLAN sources.

  • You can monitor only Ethernet VLANs.

VLAN Filtering

When you monitor a trunk port as a source port, by default, all VLANs active on the trunk are monitored. You can limit SPAN traffic monitoring on trunk source ports to specific VLANs by using VLAN filtering.

  • VLAN filtering applies only to trunk ports or to voice VLAN ports.

  • VLAN filtering applies only to port-based sessions and is not allowed in sessions with VLAN sources.

  • When a VLAN filter list is specified, only those VLANs in the list are monitored on trunk ports or on voice VLAN access ports.

  • SPAN traffic coming from other port types is not affected by VLAN filtering; that is, all VLANs are allowed on other ports.

  • VLAN filtering affects only traffic forwarded to the destination SPAN port and does not affect the switching of normal traffic.

Destination Port

Each local SPAN session or RSPAN destination session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports or VLANs and sends the SPAN packets to the user, usually a network analyzer.

A destination port has these characteristics:

  • For a local SPAN session, the destination port must reside on the same switch or switch stack as the source port. For an RSPAN session, it is located on the switch containing the RSPAN destination session. There is no destination port on a switch or switch stack running only an RSPAN source session.

  • When a port is configured as a SPAN destination port, the configuration overwrites the original port configuration. When the SPAN destination configuration is removed, the port reverts to its previous configuration. If a configuration change is made to the port while it is acting as a SPAN destination port, the change does not take effect until the SPAN destination configuration had been removed.


    Note

    When QoS is configured on the SPAN destination port, QoS takes effect immediately.

  • If the port was in an EtherChannel group, it is removed from the group while it is a destination port. If it was a routed port, it is no longer a routed port.

  • It can be any Ethernet physical port.

  • It cannot be a secure port.

  • It cannot be a source port.

  • It can participate in only one SPAN session at a time (a destination port in one SPAN session cannot be a destination port for a second SPAN session).

  • When it is active, incoming traffic is disabled. The port does not transmit any traffic except that required for the SPAN session. Incoming traffic is never learned or forwarded on a destination port.

  • If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic at Layer 2.

  • It does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP).

  • A destination port that belongs to a source VLAN of any SPAN session is excluded from the source list and is not monitored.

  • The maximum number of destination ports in a switch or switch stack is 64.

Local SPAN and RSPAN destination ports function differently with VLAN tagging and encapsulation:

  • For local SPAN, if the encapsulation replicate keywords are specified for the destination port, these packets appear with the original encapsulation (untagged, ISL, or IEEE 802.1Q). If these keywords are not specified, packets appear in the untagged format. Therefore, the output of a local SPAN session with encapsulation replicate enabled can contain a mixture of untagged, ISL, or IEEE 802.1Q-tagged packets.

  • For RSPAN, the original VLAN ID is lost because it is overwritten by the RSPAN VLAN identification. Therefore, all packets appear on the destination port as untagged.

RSPAN VLAN

The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. RSPAN VLAN has these special characteristics:

  • All traffic in the RSPAN VLAN is always flooded.

  • No MAC address learning occurs on the RSPAN VLAN.

  • RSPAN VLAN traffic only flows on trunk ports.

  • RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command.

  • STP can run on RSPAN VLAN trunks but not on SPAN destination ports.

  • An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.

For VLANs 1 to 1005 that are visible to VLAN Trunking Protocol (VTP), the VLAN ID and its associated RSPAN characteristic are propagated by VTP. If you assign an RSPAN VLAN ID in the extended VLAN range (1006 to 4094), you must manually configure all intermediate switches.

It is normal to have multiple RSPAN VLANs in a network at the same time with each RSPAN VLAN defining a network-wide RSPAN session. That is, multiple RSPAN source sessions anywhere in the network can contribute packets to the RSPAN session. It is also possible to have multiple RSPAN destination sessions throughout the network, monitoring the same RSPAN VLAN and presenting traffic to the user. The RSPAN VLAN ID separates the sessions.

Related Tasks
Creating an RSPAN Source Session
Creating an RSPAN Destination Session
Creating an RSPAN Destination Session and Configuring Incoming Traffic
Related References
Examples: Creating an RSPAN VLAN

SPAN and RSPAN Interaction with Other Features

SPAN interacts with these features:

  • Routing—SPAN does not monitor routed traffic. VSPAN only monitors traffic that enters or exits the switch, not traffic that is routed between VLANs. For example, if a VLAN is being Rx-monitored and the switch routes traffic from another VLAN to the monitored VLAN, that traffic is not monitored and not received on the SPAN destination port.

  • STP—A destination port does not participate in STP while its SPAN or RSPAN session is active. The destination port can participate in STP after the SPAN or RSPAN session is disabled. On a source port, SPAN does not affect the STP status. STP can be active on trunk ports carrying an RSPAN VLAN.

  • CDP—A SPAN destination port does not participate in CDP while the SPAN session is active. After the SPAN session is disabled, the port again participates in CDP.

  • VTP—You can use VTP to prune an RSPAN VLAN between switches.

  • VLAN and trunking—You can modify VLAN membership or trunk settings for source or destination ports at any time. However, changes in VLAN membership or trunk settings for a destination port do not take effect until you remove the SPAN destination configuration. Changes in VLAN membership or trunk settings for a source port immediately take effect, and the respective SPAN sessions automatically adjust accordingly.

  • EtherChannel—You can configure an EtherChannel group as a source port a SPAN destination port. When a group is configured as a SPAN source, the entire group is monitored.

    If a physical port is added to a monitored EtherChannel group, the new port is added to the SPAN source port list. If a port is removed from a monitored EtherChannel group, it is automatically removed from the source port list.

    A physical port that belongs to an EtherChannel group can be configured as a SPAN source port and still be a part of the EtherChannel. In this case, data from the physical port is monitored as it participates in the EtherChannel. However, if a physical port that belongs to an EtherChannel group is configured as a SPAN destination, it is removed from the group. After the port is removed from the SPAN session, it rejoins the EtherChannel group. Ports removed from an EtherChannel group remain members of the group, but they are in the inactive or suspended state.

    If a physical port that belongs to an EtherChannel group is a destination port and the EtherChannel group is a source, the port is removed from the EtherChannel group and from the list of monitored ports.

  • Multicast traffic can be monitored. For egress and ingress port monitoring, only a single unedited packet is sent to the SPAN destination port. It does not reflect the number of times the multicast packet is sent.

  • A private-VLAN port cannot be a SPAN destination port.

  • A secure port cannot be a SPAN destination port.

    For SPAN sessions, do not enable port security on ports with monitored egress when ingress forwarding is enabled on the destination port. For RSPAN source sessions, do not enable port security on any ports with monitored egress.

  • An IEEE 802.1x port can be a SPAN source port. You can enable IEEE 802.1x on a port that is a SPAN destination port; however, IEEE 802.1x is disabled until the port is removed as a SPAN destination.

    For SPAN sessions, do not enable IEEE 802.1x on ports with monitored egress when ingress forwarding is enabled on the destination port. For RSPAN source sessions, do not enable IEEE 802.1x on any ports that are egress monitored.

SPAN and RSPAN and Device Stacks

Because the stack of switches represents one logical switch, local SPAN source ports and destination ports can be in different switches in the stack. Therefore, the addition or deletion of switches in the stack can affect a local SPAN session, as well as an RSPAN source or destination session. An active session can become inactive when a switch is removed from the stack or an inactive session can become active when a switch is added to the stack.

Default SPAN and RSPAN Configuration

Table 1 Default SPAN and RSPAN Configuration

Feature

Default Setting

SPAN state (SPAN and RSPAN)

Disabled.

Source port traffic to monitor

Both received and sent traffic (both).

Encapsulation type (destination port)

Native form (untagged packets).

Ingress forwarding (destination port)

Disabled.

VLAN filtering

On a trunk interface used as a source port, all VLANs are monitored.

RSPAN VLANs

None configured.

Configuration Guidelines

SPAN Configuration Guidelines

  • To remove a source or destination port or VLAN from the SPAN session, use the no monitor session session_number source {interface interface-id | vlan vlan-id} global configuration command or the no monitor session session_number destination interface interface-id global configuration command. For destination interfaces, the encapsulation options are ignored with the no form of the command.

  • To monitor all VLANs on the trunk port, use the no monitor session session_number filter global configuration command.

Related Tasks
Creating a Local SPAN Session
Creating a Local SPAN Session and Configuring Incoming Traffic
Related References
Example: Configuring Local SPAN

RSPAN Configuration Guidelines

  • All the SPAN configuration guidelines apply to RSPAN.

  • As RSPAN VLANs have special properties, you should reserve a few VLANs across your network for use as RSPAN VLANs; do not assign access ports to these VLANs.

  • You can apply an output ACL to RSPAN traffic to selectively filter or monitor specific packets. Specify these ACLs on the RSPAN VLAN in the RSPAN source switches.

  • For RSPAN configuration, you can distribute the source ports and the destination ports across multiple switches in your network.

  • Access ports (including voice VLAN ports) on the RSPAN VLAN are put in the inactive state.

  • You can configure any VLAN as an RSPAN VLAN as long as these conditions are met:

    • The same RSPAN VLAN is used for an RSPAN session in all the switches.

    • All participating switches support RSPAN.

Related Tasks
Creating an RSPAN Source Session
Creating an RSPAN Destination Session
Creating an RSPAN Destination Session and Configuring Incoming Traffic
Related References
Examples: Creating an RSPAN VLAN

How to Configure SPAN and RSPAN

Creating a Local SPAN Session

Follow these steps to create a SPAN session and specify the source (monitored) ports or VLANs and the destination (monitoring) ports.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    no monitor session {session_number | all | local | remote}

    4.    monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx]

    5.    monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate]}

    6.    end

    7.    show running-config

    8.    copy running-config startup-config


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example: 
    Switch> enable
     

    Enables privileged EXEC mode. Enter your password if prompted.

     

    Step 2configure terminal


    Example: 
    
Switch# configure terminal
     

    Enters the global configuration mode.

     
    Step 3no monitor session {session_number | all | local | remote}


    Example: 
    
Switch(config)# no monitor session all
     

    Removes any existing SPAN configuration for the session.

    • For session_number, the range is 1 to 66.

    • all—Removes all SPAN sessions.

    • local—Removes all local sessions.

    • remote—Removes all remote SPAN sessions.

     
    Step 4monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx]

    Example: 
    
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1
     

    Specifies the SPAN session and the source port (monitored port).

    • For session_number, the range is 1 to 66.

    • For interface-id, specify the source port to monitor. Valid interfaces include physical interfaces and port-channel logical interfaces (port-channel port-channel-number). Valid port-channel numbers are 1 to 48.

    • For vlan-id, specify the source VLAN to monitor. The range is 1 to 4094 (excluding the RSPAN VLAN).

      Note   

      A single session can include multiple sources (ports or VLANs) defined in a series of commands, but you cannot combine source ports and source VLANs in one session.

    • (Optional) [, | -] Specifies a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen.

    • (Optional) both | rx | tx—Specifies the direction of traffic to monitor. If you do not specify a traffic direction, the source interface sends both sent and received traffic.

      • both—Monitors both received and sent traffic.

      • rx—Monitors received traffic.

      • tx—Monitors sent traffic.

        Note   

        You can use the monitor session session_number source command multiple times to configure multiple source ports.

     
    Step 5monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate]}


    Example: 
    
Switch(config)# monitor session 1 destination interface gigabitethernet1/0/2 encapsulation replicate
     

    Specifies the SPAN session and the destination port (monitoring port).

    Note   

    For local SPAN, you must use the same session number for the source and destination interfaces.

    • For session_number, specify the session number entered in step 4.

    • For interface-id, specify the destination port. The destination interface must be a physical port; it cannot be an EtherChannel, and it cannot be a VLAN.

    • (Optional) [, | -] Specifies a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen.

    (Optional) encapsulation replicate specifies that the destination interface replicates the source interface encapsulation method. If not selected, the default is to send packets in native form (untagged).

    Note   

    You can use monitor session session_number destination command multiple times to configure multiple destination ports.

     
    Step 6end


    Example: 
    
Switch(config)# end
     

    Returns to privileged EXEC mode.

     
    Step 7show running-config


    Example: 
    
Switch# show running-config
     

    Verifies your entries.

     
    Step 8copy running-config startup-config


    Example: 
    Switch# copy running-config startup-config
     

    (Optional) Saves your entries in the configuration file.

     
    Related Concepts
    Local SPAN
    SPAN Sessions
    SPAN Configuration Guidelines

    Creating a Local SPAN Session and Configuring Incoming Traffic

    Follow these steps to create a SPAN session, to specify the source ports or VLANs and the destination ports, and to enable incoming traffic on the destination port for a network security device (such as a Cisco IDS Sensor Appliance).

    SUMMARY STEPS

      1.    enable

      2.    configure terminal

      3.    no monitor session {session_number | all | local | remote}

      4.    monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx]

      5.    monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate] [ingress {dot1q vlan vlan-id | untagged vlan vlan-id | vlan vlan-id}]}

      6.    end

      7.    show running-config

      8.    copy running-config startup-config


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example: 
      Switch> enable
       

      Enables privileged EXEC mode. Enter your password if prompted.

       

      Step 2configure terminal


      Example: 
      
Switch# configure terminal
       

      Enters the global configuration mode.

       
      Step 3no monitor session {session_number | all | local | remote}


      Example: 
      
Switch(config)# no monitor session all
       

      Removes any existing SPAN configuration for the session.

      • For session_number, the range is 1 to 66.

      • all—Removes all SPAN sessions.

      • local—Removes all local sessions.

      • remote—Removes all remote SPAN sessions.

       
      Step 4monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx]


      Example: 
      
Switch(config)# monitor session 2 source gigabitethernet1/0/1 rx
       

      Specifies the SPAN session and the source port (monitored port).

       
      Step 5monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate] [ingress {dot1q vlan vlan-id | untagged vlan vlan-id | vlan vlan-id}]}


      Example: 
      
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 encapsulation replicate ingress dot1q vlan 6
       

      Specifies the SPAN session, the destination port, the packet encapsulation, and the ingress VLAN and encapsulation.

      • For session_number, specify the session number entered in Step 4.

      • For interface-id, specify the destination port. The destination interface must be a physical port; it cannot be an EtherChannel, and it cannot be a VLAN.

      • (Optional) [, | -]—Specifies a series or range of interfaces. Enter a space before and after the comma or hyphen.

      • (Optional) encapsulation replicate specifies that the destination interface replicates the source interface encapsulation method. If not selected, the default is to send packets in native form (untagged).

      • ingress enables forwarding of incoming traffic on the destination port and to specify the encapsulation type:

        • dot1q vlan vlan-id—Accepts incoming packets with IEEE 802.1Q encapsulation with the specified VLAN as the default VLAN.

        • untagged vlan vlan-id or vlan vlan-id—Accepts incoming packets with untagged encapsulation type with the specified VLAN as the default VLAN.

       
      Step 6end


      Example: 
      
Switch(config)# end
       

      Returns to privileged EXEC mode.

       
      Step 7show running-config


      Example: 
      
Switch# show running-config
       

      Verifies your entries.

       
      Step 8copy running-config startup-config


      Example: 
      Switch# copy running-config startup-config
       

      (Optional) Saves your entries in the configuration file.

       
      Related Concepts
      Local SPAN
      SPAN Sessions
      SPAN Configuration Guidelines
      Related References
      Example: Configuring Local SPAN

      Specifying VLANs to Filter

      Follow these steps to limit SPAN source traffic to specific VLANs.

      SUMMARY STEPS

        1.    enable

        2.    configure terminal

        3.    no monitor session {session_number | all | local | remote}

        4.    monitor session session_number source interface interface-id

        5.    monitor session session_number filter vlan vlan-id [, | -]

        6.    monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate]}

        7.    end

        8.    show running-config

        9.    copy running-config startup-config


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example: 
        Switch> enable
         

        Enables privileged EXEC mode. Enter your password if prompted.

         

        Step 2configure terminal


        Example: 
        
Switch# configure terminal
         

        Enters the global configuration mode.

         
        Step 3no monitor session {session_number | all | local | remote}


        Example: 
        
Switch(config)# no monitor session all
         

        Removes any existing SPAN configuration for the session.

        • For session_number, the range is 1 to 66.

        • all—Removes all SPAN sessions.

        • local—Removes all local sessions.

        • remote—Removes all remote SPAN sessions.

         
        Step 4monitor session session_number source interface interface-id


        Example: 
        
Switch(config)# monitor session 2 source interface gigabitethernet1/0/2 rx
         

        Specifies the characteristics of the source port (monitored port) and SPAN session.

        • For session_number, the range is 1 to 66.

        • For interface-id, specify the source port to monitor. The interface specified must already be configured as a trunk port.

         
        Step 5monitor session session_number filter vlan vlan-id [, | -]


        Example: 
        
Switch(config)# monitor session 2 filter vlan 1 - 5 , 9
         

        Limits the SPAN source traffic to specific VLANs.

        • For session_number, enter the session number specified in Step 4.

        • For vlan-id, the range is 1 to 4094.

        • (Optional) Use a comma (,) to specify a series of VLANs, or use a hyphen (-) to specify a range of VLANs. Enter a space before and after the comma; enter a space before and after the hyphen.

         
        Step 6monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate]}


        Example: 
        
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/1
         

        Specifies the SPAN session and the destination port (monitoring port).

        • For session_number, specify the session number entered in Step 4.

        • For interface-id, specify the destination port. The destination interface must be a physical port; it cannot be an EtherChannel, and it cannot be a VLAN.

        • (Optional) [, | -] Specifies a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen.

        • (Optional) encapsulation replicate specifies that the destination interface replicates the source interface encapsulation method. If not selected, the default is to send packets in native form (untagged).

         
        Step 7end


        Example: 
        
Switch(config)# end
         

        Returns to privileged EXEC mode.

         
        Step 8show running-config


        Example: 
        
Switch# show running-config
         

        Verifies your entries.

         
        Step 9copy running-config startup-config


        Example: 
        Switch# copy running-config startup-config
         

        (Optional) Saves your entries in the configuration file.

         

        Configuring a VLAN as an RSPAN VLAN

        Follow these steps to create a new VLAN, then configure it to be the RSPAN VLAN for the RSPAN session.

        SUMMARY STEPS

          1.    enable

          2.    configure terminal

          3.    vlan vlan-id

          4.    remote-span

          5.    end

          6.    show running-config

          7.    copy running-config startup-config


        DETAILED STEPS
           Command or ActionPurpose
          Step 1 enable


          Example: 
          Switch> enable
           

          Enables privileged EXEC mode. Enter your password if prompted.

           

          Step 2configure terminal


          Example: 
          
Switch# configure terminal
           

          Enters the global configuration mode.

           
          Step 3vlan vlan-id


          Example: 
          
Switch(config)# vlan 100
           

          Enters a VLAN ID to create a VLAN, or enters the VLAN ID of an existing VLAN, and enters VLAN configuration mode. The range is 2 to 1001 and 1006 to 4094.

          The RSPAN VLAN cannot be VLAN 1 (the default VLAN) or VLAN IDs 1002 through 1005 (reserved for Token Ring and FDDI VLANs).

           
          Step 4remote-span


          Example: 
          
Switch(config-vlan)# remote-span
           

          Configures the VLAN as an RSPAN VLAN.

           
          Step 5end


          Example: 
          
Switch(config-vlan)# end
           

          Returns to privileged EXEC mode.

           
          Step 6show running-config


          Example: 
          
Switch# show running-config
           

          Verifies your entries.

           
          Step 7copy running-config startup-config


          Example: 
          Switch# copy running-config startup-config
           

          (Optional) Saves your entries in the configuration file.

           
          What to Do Next

          You must create the RSPAN VLAN in all switches that will participate in RSPAN. If the RSPAN VLAN-ID is in the normal range (lower than 1005) and VTP is enabled in the network, you can create the RSPAN VLAN in one switch, and VTP propagates it to the other switches in the VTP domain. For extended-range VLANs (greater than 1005), you must configure RSPAN VLAN on both source and destination switches and any intermediate switches.

          Use VTP pruning to get an efficient flow of RSPAN traffic, or manually delete the RSPAN VLAN from all trunks that do not need to carry the RSPAN traffic.

          To remove the remote SPAN characteristic from a VLAN and convert it back to a normal VLAN, use the no remote-span VLAN configuration command.

          To remove a source port or VLAN from the SPAN session, use the no monitor session session_number source {interface interface-id | vlan vlan-id} global configuration command. To remove the RSPAN VLAN from the session, use the no monitor session session_number destination remote vlan vlan-id.

          Creating an RSPAN Source Session

          Follow these steps to create and start an RSPAN source session and to specify the monitored source and the destination RSPAN VLAN.

          SUMMARY STEPS

            1.    enable

            2.    configure terminal

            3.    no monitor session {session_number | all | local | remote}

            4.    monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx]

            5.    monitor session session_number destination remote vlan vlan-id

            6.    end

            7.    show running-config

            8.    copy running-config startup-config


          DETAILED STEPS
             Command or ActionPurpose
            Step 1 enable


            Example: 
            Switch> enable
             

            Enables privileged EXEC mode. Enter your password if prompted.

             

            Step 2configure terminal


            Example: 
            
Switch# configure terminal
             

            Enters the global configuration mode.

             
            Step 3no monitor session {session_number | all | local | remote}


            Example: 
            
Switch(config)# no monitor session 1
             

            Removes any existing SPAN configuration for the session.

            • For session_number, the range is 1 to 66.

            • all—Removes all SPAN sessions.

            • local—Removes all local sessions.

            • remote—Removes all remote SPAN sessions.

             
            Step 4monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx]


            Example: 
            
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 tx
             

            Specifies the RSPAN session and the source port (monitored port).

            • For session_number, the range is 1 to 66.

            • Enter a source port or source VLAN for the RSPAN session:

              • For interface-id, specifies the source port to monitor. Valid interfaces include physical interfaces and port-channel logical interfaces (port-channel port-channel-number). Valid port-channel numbers are 1 to 48.

              • For vlan-id, specifies the source VLAN to monitor. The range is 1 to 4094 (excluding the RSPAN VLAN).

                A single session can include multiple sources (ports or VLANs), defined in a series of commands, but you cannot combine source ports and source VLANs in one session.

            • (Optional) [, | -]—Specifies a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen.

            • (Optional) both | rx | tx—Specifies the direction of traffic to monitor. If you do not specify a traffic direction, the source interface sends both sent and received traffic.

              • both—Monitors both received and sent traffic.

              • rx—Monitors received traffic.

              • tx—Monitors sent traffic.

             
            Step 5monitor session session_number destination remote vlan vlan-id


            Example: 
            
Switch(config)# monitor session 1 destination remote vlan 100
             

            Specifies the RSPAN session, the destination RSPAN VLAN, and the destination-port group.

            • For session_number, enter the number defined in Step 4.

            • For vlan-id, specify the source RSPAN VLAN to monitor.

             
            Step 6end


            Example: 
            
Switch(config)# end
             

            Returns to privileged EXEC mode.

             
            Step 7show running-config


            Example: 
            
Switch# show running-config
             

            Verifies your entries.

             
            Step 8copy running-config startup-config


            Example: 
            Switch# copy running-config startup-config
             

            (Optional) Saves your entries in the configuration file.

             
            Related Concepts
            Remote SPAN
            RSPAN VLAN
            RSPAN Configuration Guidelines

            Specifying VLANs to Filter

            Follow these steps to configure the RSPAN source session to limit RSPAN source traffic to specific VLANs.

            SUMMARY STEPS

              1.    enable

              2.    configure terminal

              3.    no monitor session {session_number | all | local | remote}

              4.    monitor session session_number source interface interface-id

              5.    monitor session session_number filter vlan vlan-id [, | -]

              6.    monitor session session_number destination remote vlan vlan-id

              7.    end

              8.    show running-config

              9.    copy running-config startup-config


            DETAILED STEPS
               Command or ActionPurpose
              Step 1 enable


              Example: 
              Switch> enable
               

              Enables privileged EXEC mode. Enter your password if prompted.

               

              Step 2configure terminal


              Example: 
              
Switch# configure terminal
               

              Enters the global configuration mode.

               
              Step 3no monitor session {session_number | all | local | remote}


              Example: 
              
Switch(config)# no monitor session 2
               

              Removes any existing SPAN configuration for the session.

              • For session_number, the range is 1 to 66.

              • all—Removes all SPAN sessions.

              • local—Removes all local sessions.

              • remote—Removes all remote SPAN sessions.

               
              Step 4monitor session session_number source interface interface-id


              Example: 
              
Switch(config)# monitor session 2 source interface gigabitethernet1/0/2 rx
               

              Specifies the characteristics of the source port (monitored port) and SPAN session.

              • For session_number, the range is 1 to 66.

              • For interface-id, specify the source port to monitor. The interface specified must already be configured as a trunk port.

               
              Step 5monitor session session_number filter vlan vlan-id [, | -]


              Example: 
              
Switch(config)# monitor session 2 filter vlan 1 - 5 , 9
               

              Limits the SPAN source traffic to specific VLANs.

              • For session_number, enter the session number specified in step 4.

              • For vlan-id, the range is 1 to 4094.

              • (Optional) , | - Use a comma (,) to specify a series of VLANs or use a hyphen (-) to specify a range of VLANs. Enter a space before and after the comma; enter a space before and after the hyphen.

               
              Step 6monitor session session_number destination remote vlan vlan-id


              Example: 
              
Switch(config)# monitor session 2 destination remote vlan 902
               

              Specifies the RSPAN session and the destination remote VLAN (RSPAN VLAN).

              • For session_number, enter the session number specified in Step 4.

              • For vlan-id, specify the RSPAN VLAN to carry the monitored traffic to the destination port.

               
              Step 7end


              Example: 
              
Switch(config)# end
               

              Returns to privileged EXEC mode.

               
              Step 8show running-config


              Example: 
              
Switch# show running-config
               

              Verifies your entries.

               
              Step 9copy running-config startup-config


              Example: 
              Switch# copy running-config startup-config
               

              (Optional) Saves your entries in the configuration file.

               

              Creating an RSPAN Destination Session

              You configure an RSPAN destination session on a different switch or switch stack; that is, not the switch or switch stack on which the source session was configured.

              Follow these steps to define the RSPAN VLAN on that switch, to create an RSPAN destination session, and to specify the source RSPAN VLAN and the destination port.

              SUMMARY STEPS

                1.    enable

                2.    configure terminal

                3.    vlan vlan-id

                4.    remote-span

                5.    exit

                6.    no monitor session {session_number | all | local | remote}

                7.    monitor session session_number source remote vlan vlan-id

                8.    monitor session session_number destination interface interface-id

                9.    end

                10.    show running-config

                11.    copy running-config startup-config


              DETAILED STEPS
                 Command or ActionPurpose
                Step 1 enable


                Example: 
                Switch> enable
                 

                Enables privileged EXEC mode. Enter your password if prompted.

                 

                Step 2configure terminal


                Example: 
                
Switch# configure terminal
                 

                Enters the global configuration mode.

                 
                Step 3vlan vlan-id


                Example: 
                
Switch(config)# vlan 901
                 

                Specifies the VLAN ID of the RSPAN VLAN created from the source switch, and enters VLAN configuration mode.

                If both switches are participating in VTP and the RSPAN VLAN ID is from 2 to 1005, Steps 3 through 5 are not required because the RSPAN VLAN ID is propagated through the VTP network.

                 
                Step 4remote-span


                Example: 
                
Switch(config-vlan)# remote-span
                 

                Identifies the VLAN as the RSPAN VLAN.

                 
                Step 5exit


                Example: 
                
Switch(config-vlan)# exit
                 

                Returns to global configuration mode.

                 
                Step 6no monitor session {session_number | all | local | remote}


                Example: 
                
Switch(config)# no monitor session 1
                 

                Removes any existing SPAN configuration for the session.

                • For session_number, the range is 1 to 66.

                • all—Removes all SPAN sessions.

                • local—Removes all local sessions.

                • remote—Removes all remote SPAN sessions.

                 
                Step 7monitor session session_number source remote vlan vlan-id


                Example: 
                
Switch(config)# monitor session 1 source remote vlan 901
                 

                Specifies the RSPAN session and the source RSPAN VLAN.

                • For session_number, the range is 1 to 66.

                • For vlan-id, specify the source RSPAN VLAN to monitor.

                 
                Step 8monitor session session_number destination interface interface-id


                Example: 
                
Switch(config)# monitor session 1 destination interface gigabitethernet2/0/1
                 

                Specifies the RSPAN session and the destination interface.

                • For session_number, enter the number defined in Step 7.

                  In an RSPAN destination session, you must use the same session number for the source RSPAN VLAN and the destination port.

                • For interface-id, specify the destination interface. The destination interface must be a physical interface.

                • Though visible in the command-line help string, encapsulation replicate is not supported for RSPAN. The original VLAN ID is overwritten by the RSPAN VLAN ID, and all packets appear on the destination port as untagged.

                 
                Step 9end


                Example: 
                
Switch(config)# end
                 

                Returns to privileged EXEC mode.

                 
                Step 10show running-config


                Example: 
                
Switch# show running-config
                 

                Verifies your entries.

                 
                Step 11copy running-config startup-config


                Example: 
                Switch# copy running-config startup-config
                 

                (Optional) Saves your entries in the configuration file.

                 
                Related Concepts
                Remote SPAN
                RSPAN VLAN
                RSPAN Configuration Guidelines

                Creating an RSPAN Destination Session and Configuring Incoming Traffic

                Follow these steps to create an RSPAN destination session, to specify the source RSPAN VLAN and the destination port, and to enable incoming traffic on the destination port for a network security device (such as a Cisco IDS Sensor Appliance).

                SUMMARY STEPS

                  1.    enable

                  2.    configure terminal

                  3.    no monitor session {session_number | all | local | remote}

                  4.    monitor session session_number source remote vlan vlan-id

                  5.    monitor session session_number destination {interface interface-id [, | -] [ingress {dot1q vlan vlan-id | untagged vlan vlan-id | vlan vlan-id}]}

                  6.    end

                  7.    show running-config

                  8.    copy running-config startup-config


                DETAILED STEPS
                   Command or ActionPurpose
                  Step 1 enable


                  Example: 
                  Switch> enable
                   

                  Enables privileged EXEC mode. Enter your password if prompted.

                   

                  Step 2configure terminal


                  Example: 
                  
Switch# configure terminal
                   

                  Enters the global configuration mode.

                   
                  Step 3no monitor session {session_number | all | local | remote}


                  Example: 
                  
Switch(config)# no monitor session 2
                   

                  Removes any existing SPAN configuration for the session.

                  • For session_number, the range is 1 to 66.

                  • all—Removes all SPAN sessions.

                  • local—Removes all local sessions.

                  • remote—Removes all remote SPAN sessions.

                   
                  Step 4monitor session session_number source remote vlan vlan-id


                  Example: 
                  
Switch(config)# monitor session 2 source remote vlan 901
                   

                  Specifies the RSPAN session and the source RSPAN VLAN.

                  • For session_number, the range is 1 to 66.

                  • For vlan-id, specify the source RSPAN VLAN to monitor.

                   
                  Step 5monitor session session_number destination {interface interface-id [, | -] [ingress {dot1q vlan vlan-id | untagged vlan vlan-id | vlan vlan-id}]}

                  Example: 
                  
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 ingress vlan 6
                   

                  Specifies the SPAN session, the destination port, the packet encapsulation, and the incoming VLAN and encapsulation.

                  • For session_number, enter the number defined in Step 5.

                    In an RSPAN destination session, you must use the same session number for the source RSPAN VLAN and the destination port.

                  • For interface-id, specify the destination interface. The destination interface must be a physical interface.

                  • Though visible in the command-line help string, encapsulation replicate is not supported for RSPAN. The original VLAN ID is overwritten by the RSPAN VLAN ID, and all packets appear on the destination port as untagged.

                  • (Optional) [, | -] Specifies a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen.

                  • Enter ingress with additional keywords to enable forwarding of incoming traffic on the destination port and to specify the encapsulation type:

                    • dot1q vlan vlan-id—Forwards incoming packets with IEEE 802.1Q encapsulation with the specified VLAN as the default VLAN.

                    • untagged vlan vlan-id or vlan vlan-id—Forwards incoming packets with untagged encapsulation type with the specified VLAN as the default VLAN.

                   
                  Step 6end


                  Example: 
                  
Switch(config)# end
                   

                  Returns to privileged EXEC mode.

                   
                  Step 7show running-config


                  Example: 
                  
Switch# show running-config
                   

                  Verifies your entries.

                   
                  Step 8copy running-config startup-config


                  Example: 
                  Switch# copy running-config startup-config
                   

                  (Optional) Saves your entries in the configuration file.

                   
                  Related Concepts
                  Remote SPAN
                  RSPAN VLAN
                  RSPAN Configuration Guidelines
                  Related References
                  Examples: Creating an RSPAN VLAN

                  Monitoring SPAN and RSPAN Operations

                  The following table describes the command used to display SPAN and RSPAN operations configuration and results to monitor operations:

                  Table 2 Monitoring SPAN and RSPAN Operations
                  Command Purpose

                  show monitor

                  Displays the current SPAN, RSPAN, FSPAN, or FRSPAN configuration.

                  SPAN and RSPAN Configuration Examples

                  Example: Configuring Local SPAN

                  This example shows how to set up SPAN session 1 for monitoring source port traffic to a destination port. First, any existing SPAN configuration for session 1 is deleted, and then bidirectional traffic is mirrored from source Gigabit Ethernet port 1 to destination Gigabit Ethernet port 2, retaining the encapsulation method. 

                  
Switch> enable
Switch# configure terminal
Switch(config)# no monitor session 1
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1
Switch(config)# monitor session 1 destination interface gigabitethernet1/0/2 encapsulation replicate
Switch(config)# end

                  This example shows how to remove port 1 as a SPAN source for SPAN session 1: 

                  
Switch> enable
Switch# configure terminal
Switch(config)# no monitor session 1 source interface gigabitethernet1/0/1
Switch(config)# end

                  This example shows how to disable received traffic monitoring on port 1, which was configured for bidirectional monitoring: 

                  
Switch> enable
Switch# configure terminal
Switch(config)# no monitor session 1 source interface gigabitethernet1/0/1 rx

                  The monitoring of traffic received on port 1 is disabled, but traffic sent from this port continues to be monitored.

                  This example shows how to remove any existing configuration on SPAN session 2, configure SPAN session 2 to monitor received traffic on all ports belonging to VLANs 1 through 3, and send it to destination Gigabit Ethernet port 2. The configuration is then modified to also monitor all traffic on all ports belonging to VLAN 10. 

                  
Switch> enable
Switch# configure terminal
Switch(config)# no monitor session 2
Switch(config)# monitor session 2 source vlan 1 - 3 rx
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2
Switch(config)# monitor session 2 source vlan 10
Switch(config)# end

                  This example shows how to remove any existing configuration on SPAN session 2, configure SPAN session 2 to monitor received traffic on Gigabit Ethernet source port 1, and send it to destination Gigabit Ethernet port 2 with the same egress encapsulation type as the source port, and to enable ingress forwarding with IEEE 802.1Q encapsulation and VLAN 6 as the default ingress VLAN: 

                  
Switch> enable
Switch# configure terminal
Switch(config)# no monitor session 2
Switch(config)# monitor session 2 source gigabitethernet1/0/1 rx
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 encapsulation replicate ingress dot1q vlan 6
Switch(config)# end

                  This example shows how to remove any existing configuration on SPAN session 2, configure SPAN session 2 to monitor traffic received on Gigabit Ethernet trunk port 2, and send traffic for only VLANs 1 through 5 and VLAN 9 to destination Gigabit Ethernet port 1: 

                  
Switch> enable
Switch# configure terminal
Switch(config)# no monitor session 2
Switch(config)# monitor session 2 source interface gigabitethernet1/0/2 rx
Switch(config)# monitor session 2 filter vlan 1 - 5 , 9
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/1
Switch(config)# end
                  Related Concepts
                  Local SPAN
                  SPAN Sessions
                  SPAN Configuration Guidelines
                  Related Tasks
                  Creating a Local SPAN Session and Configuring Incoming Traffic

                  Examples: Creating an RSPAN VLAN

                  This example shows how to create the RSPAN VLAN 901: 

                  
Switch> enable
Switch# configure terminal
Switch(config)# vlan 901
Switch(config-vlan)# remote span
Switch(config-vlan)# end

                  This example shows how to remove any existing RSPAN configuration for session 1, configure RSPAN session 1 to monitor multiple source interfaces, and configure the destination as RSPAN VLAN 901: 

                  
Switch> enable
Switch# configure terminal
Switch(config)# no monitor session 1
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 tx
Switch(config)# monitor session 1 source interface gigabitethernet1/0/2 rx
Switch(config)# monitor session 1 source interface port-channel 2
Switch(config)# monitor session 1 destination remote vlan 901
Switch(config)# end

                  This example shows how to remove any existing configuration on RSPAN session 2, configure RSPAN session 2 to monitor traffic received on trunk port 2, and send traffic for only VLANs 1 through 5 and 9 to destination RSPAN VLAN 902: 

                  
Switch> enable
Switch# configure terminal
Switch(config)# no monitor session 2
Switch(config)# monitor session 2 source interface gigabitethernet1/0/2 rx
Switch(config)# monitor session 2 filter vlan 1 - 5 , 9
Switch(config)# monitor session 2 destination remote vlan 902
Switch(config)# end

                  This example shows how to configure VLAN 901 as the source remote VLAN and port 1 as the destination interface: 

                  
Switch> enable
Switch# configure terminal
Switch(config)# monitor session 1 source remote vlan 901
Switch(config)# monitor session 1 destination interface gigabitethernet2/0/1
Switch(config)# end

                  This example shows how to configure VLAN 901 as the source remote VLAN in RSPAN session 2, to configure Gigabit Ethernet source port 2 as the destination interface, and to enable forwarding of incoming traffic on the interface with VLAN 6 as the default receiving VLAN: 

                  
Switch> enable
Switch# configure terminal
Switch(config)# monitor session 2 source remote vlan 901
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 ingress vlan 6
Switch(config)# end
                  Related Concepts
                  Remote SPAN
                  RSPAN VLAN
                  RSPAN Configuration Guidelines
                  Related Tasks
                  Creating an RSPAN Destination Session and Configuring Incoming Traffic

                  Additional References

                  Related Documents

                  Related Topic Document Title
                  System Commands

                  Network Management Command Reference, Cisco IOS Release 15.2(2)E

                  Error Message Decoder

                  Description Link

                  To help you research and resolve system error messages in this release, use the Error Message Decoder tool.

                  https:/​/​www.cisco.com/​cgi-bin/​Support/​Errordecoder/​index.cgi

                  Standards and RFCs

                  Standard/RFC Title

                  None

                  -

                  MIBs

                  MIB MIBs Link

                  All supported MIBs for this release.

                  To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

                  http:/​/​www.cisco.com/​go/​mibs

                  Technical Assistance

                  Description Link

                  The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

                  To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

                  Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

                  http:/​/​www.cisco.com/​support

                  Feature History and Information for SPAN and RSPAN

                  Release Modification

                  Cisco IOS 15.0(2)EX

                  Switch Port Analyzer (SPAN): Allows monitoring of switch traffic on a port or VLAN using a sniffer/analyzer or RMON probe.

                  This feature was introduced.

                  Cisco IOS 15.0(2)EX

                  SPAN destination port support on EtherChannels: Provides the ability to configure a SPAN destination port on an EtherChannel.

                  This feature was introduced.

                  Cisco IOS 15.0(2)EX

                  Switch Port Analyzer (SPAN) - distributed egress SPAN: Provides distributed egress SPAN functionality onto line cards in conjunction with ingress SPAN already been distributed to line cards. By distributing egress SPAN functionalities onto line cards, the performance of the system is improved.

                  This feature was introduced.