This chapter contains a sample local and remote switched port analyzer feature configuration.

Switched Port Analyzer (SPAN) refers to selecting network traffic for analysis by a network analyzer. SPAN feature is introduced on switches as the switch forwards traffic that is destined for a MAC address directly to the corresponding port leaving no scope to analyze the traffic.

SPAN monitors the traffic on source port and sends a copy of the traffic to a destination port. The network analyzer, which is attached to the destination port, analyzes the received traffic. Source port can be a single port or multiple ports. A replication of the packets is sent to the destination port for analysis

SPAN is originally referred to port mirroring or port monitoring where all the network traffic on the source port is mirrored to destination port. Port mirroring has three subdivisions.

With enhancements to SPAN, mirroring can be classified into three categories.

In port mirroring, source will be a port which could be a physical interface or a port channel. All the traffic on the source port will be mirrored to destination port. Either traffic received on the source port or traffic transmitted from the source port or both can be monitored.

Also, the mirrored packet would be having default TPID of the mirror destination port i.e. 0x8100.

In VLAN mirroring, the source is a VLAN identifier and the traffic received on all ports with the VLAN identifier matching source VLAN identifier are mirrored to destination port.

This example shows detailed configuration of port mirroring.

Enter the below commands to confirm the configurations.

 

If monitor session configured with two source interface as egress direction (tx) then the destination port will receive only one copy of the egressed packet.

If you send 10 frames from xe20 packets egress via xe10 and xe30, then on mirror destination port only 10 packets are received.

This example shows detailed configuration of VLAN with rule based mirroring.

Enter the below commands to confirm the configurations.

When several switches need to be analyzed with a single centralized sniffer, remote switched port analyzer (RSPAN) is used. In RSPAN, all the mirrored traffic will be tagged with a RSPAN VLAN ID and forwarded to remote destination via a port called reflector port. Reflector port will have the same characteristics of a local destination port. RSPAN VLAN ID will be a dedicated VLAN for the monitoring purpose and will not participate in bridging. RSPAN destination switch will strip the RSPAN VLAN tag and send it the sniffer for analysis. RSPAN will have the same sub-categories as SPAN except that the mirrored traffic will be tagged with RSPAN VLAN header and forwarded to destination switch for analysis.

Enter the commands below to confirm the configurations

This example shows detailed configuration of VLAN with rule based mirroring.

Enter the commands below to confirm the configuration.