SPAN PORT EXPLAINED


REFERENCE

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2940/software/release/12-1_19_ea1/configuration/guide/2940scg_1/swspan.html#wp1044603


 

TOPICS

WHAT IS SPAN?

HOW SPAN ANALYSES TRAFFIC, EXAMPLE SCENARIO, SWITCH PORT STATUS


 

WHAT IS SPAN?

SPAN means Switch Port Analyser. As name suggest, we use SPAN to analyse the traffic of a switch port.


 

HOW SPAN ANALYSES TRAFFIC?

SPAN makes out the mirror traffic, which is copy of the traffic, that needs to be observed.

EXAMPLE SCENARIO

There is a host(IP Phone) connected at port F0/20 of the switch. But, we are facing issues with the traffic

of this port, F0/20.

What our Plan is, we want to analyse the traffic

Analysis of traffic will be done by some software(e.g.: Wire shark)

This software requires traffic to be analysed

Now, SPAN comes into the picture, which mirror the actual traffic and then, we will provide that traffic to

some software, then traffic analysed and we get the clear picture, what is happening with the traffic.

 

 

Configuration

Switch(config)# monitor session 1 source interface fastEthernet0/20

Switch(config)# monitor session 1 destination interface fastEthernet0/30

 

Configuration Details

Here, Monitoring session is configured

F0/20 is the source port and F0/30 is the Destination port

Traffic going on F0/20 gets mirrored to the F0/30,

Then from F0/30, traffic will be sent to some software to analyse

 

How to Verify SPAN Session?

Switch# show monitor session 1

Session 1

Type : Local Session

Source Ports :

RX Only : None

TX Only : None

Both : Fa0/4

Source VLANs :

RX Only : None

TX Only : None

Both : None

Source RSPAN VLAN : None

Destination Ports : Fa0/5

Encapsulation: DOT1Q

Ingress: Enabled, default VLAN = 5

Reflector Port : None

Filter VLANs : None

Dest RSPAN VLAN : None

 

How to remove SPAN Session?

Switch(config)# no monitor session 1   
/1 is the monitoring session number/

SWITCH PORT STATUS

Reference

http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html#anc60

 

Destination port status is Up/ Down, which is normal. Generally, if switch port status is Up/Down, it is a problem. Here, it is normal behaviour.

 

In our example, Switch port, F0/30 status after configuring SPAN will be Up/Down.

This behaviour is actually designed like this. The interface shows the port in this state in order to make it evident that the port is currently not usable as a production port. The port as up/down monitoring is normal.


 

That’ all to understand, try to use SPAN and analyse traffic with some software, to make it more clear .. !!

 

 

 

 

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s