Local Span, Rspan, And Erspan Sources - Cisco 7604 Configuration Manual
Ios software configuration guide
Hide thumbs
Also See for 7604:
- Configuration manual (742 pages) ,
- Installation manual (324 pages) ,
- User manual (98 pages)
Table of Contents
Advertisement
Chapter 52
Configuring Local SPAN, RSPAN, and ERSPAN
Monitored Traffic Direction
You can configure local SPAN sessions, RSPAN source sessions, and ERSPAN source sessions to
monitor ingress traffic (called ingress SPAN), or to monitor egress traffic (called egress SPAN), or to
monitor traffic flowing in both directions.
Ingress SPAN copies traffic received by the source ports and VLANs for analysis at the destination port.
Egress SPAN copies traffic transmitted from the source ports and VLANs. When you enter the both
keyword, SPAN copies the traffic received and transmitted by the source ports and VLANs to the
destination port.
Monitored Traffic
By default, local SPAN and ERSPAN monitor all traffic, including multicast and bridge protocol data
unit (BPDU) frames. RSPAN does not support BPDU monitoring.
Duplicate Traffic
In some configurations, SPAN sends multiple copies of the same source traffic to the destination port.
For example, in a configuration with a bidirectional SPAN session (both ingress and egress) for two
SPAN sources, called s1 and s2, to a SPAN destination port, called d1, if a packet enters the router
through s1 and is sent for egress from the switch to s2, ingress SPAN at s1 sends a copy of the packet to
SPAN destination d1 and egress SPAN at s2 sends a copy of the packet to SPAN destination d1. If the
packet was Layer 2 switched from s1 to s2, both SPAN packets would be the same. If the packet was
Layer 3 switched from s1 to s2, the Layer 3 rewrite would alter the source and destination Layer 2
addresses, in which case the SPAN packets would be different.
Local SPAN, RSPAN, and ERSPAN Sources
These sections describe local SPAN, RSPAN, and ERSPAN sources:
•
•
Source Ports
A source port is a port monitored for traffic analysis. You can configure both switched and routed ports
as SPAN source ports. SPAN can monitor one or more source ports in a single SPAN session. You can
configure source ports in any VLAN. Trunk ports can be configured as source ports and mixed with
nontrunk source ports. SPAN does not copy the encapsulation from a source trunk port.
Source VLANs
A source VLAN is a VLAN monitored for traffic analysis. VLAN-based SPAN (VSPAN) uses a VLAN
as the SPAN source. All the ports in the source VLANs become source ports.
OL-4266-08
Source Ports, page 52-5
Source VLANs, page 52-5
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
Understanding How Local SPAN, RSPAN, and ERSPAN Work
52-5
- Quick Links:
- Supported Hardware and Software
Hide quick links:
Advertisement
Chapters
Table of Contents
