Cisco ME 3800x and ME 3600x Switches Software Configuration Guide, Cisco IOS Release 15.4(2)S

Switched Port Analyzer (SPAN) Session

A Switched Port Analyzer (SPAN) session is an association of a destination interface with a set of source interfaces. You configure SPAN sessions using parameters that specify the type of network traffic to monitor. SPAN sessions allow you to monitor traffic on one or more interfaces and to send either ingress traffic, egress traffic, or both to one destination interface. You can configure a SPAN session with separate sets of SPAN source interfaces; overlapping sets are not supported.

SPAN sessions do not interfere with the normal operation of the switch. You can enable or disable SPAN sessions with command-line interface (CLI) or SNMP commands. When enabled, a SPAN session might become active or inactive based on various events or actions, which are indicated by syslog messages. The show monitor session command displays the operational status of a SPAN session.

A SPAN session remains inactive after system power-up until the destination interface is operational.

Destination Interface

A destination interface, also called a monitor interface, is a switched interface to which SPAN sends packets for analysis. You can have one SPAN destination interface.

An interface configured as a destination interface cannot be configured as a source interface.

Specifying a trunk interface as a SPAN destination interface stops trunking on the interface.

Source Interface

A source interface is an interface monitored for network traffic analysis. An interface configured as a source interface cannot be configured as a destination interface.

Traffic Types

Ingress SPAN (Rx) copies network traffic received by the source interfaces for analysis at the destination interface. Egress SPAN (Tx) copies network traffic transmitted from the source interfaces. Specifying the configuration option, both, copies network traffic received and transmitted by the source interfaces to the destination interface.

SPAN Traffic

Network traffic, including multicast, can be monitored using SPAN. Multicast packet monitoring is enabled by default. In some SPAN configurations, multiple copies of the same source packet are sent to the SPAN destination interface. For example, a bidirectional (both ingress and egress) SPAN session is configured for sources a1 and a2 to a destination interface d1. If a packet enters the switch through a1 and gets switched to a2, both incoming and outgoing packets are sent to destination interface d1; both packets would be the same (unless a Layer-3 rewrite had occurred, in which case the packets would be different).

Note For ME3600/ME3800 switches, a maximum of 1 Gbps SPAN traffic is supported.

Configuring Sources and Destinations for SPAN

To configure sources and destinations for a SPAN session, perform this task in privileged EXEC mode:

SUMMARY STEPS

1. configure terminal

2. monitor session {session_number} type local

3. source {interface slot/port}} [, | - | rx | tx | both]

4. destination {interface slot/port}} [, | - | rx | tx | both]

5. no shutdown

DETAILED STEPS

Note You can configure multiple SPAN sessions, but only one SPAN session is supported at a time.

Removing Sources and Destinations from a SPAN Session

To remove sources or destinations from a SPAN session, use the following commands beginning in privileged EXEC mode:

SUMMARY STEPS

1. configure terminal

2. no monitor session session_number

DETAILED STEPS

Configuring Sources and Destinations Example

The following example shows how to configure SPAN session 1 to monitor bidirectional traffic from source interface Gigabit Ethernet 2/1 and destination interface Gigabit Ethernet 2/4:

Removing Sources and Destinations from a SPAN Session Example

The following example shows how to remove a SPAN session:

Displaying SPAN Session Information

To display information about the SPAN sessions you configured, use the show monitor session command:

show monitor session [ range session-range | local | remote | all | session ]

This example shows how to display information for a specific session:

This example shows how to display the detailed information for a specific session: