Monitor port-A monitor port is also a destination SPAN port in Catalyst 2900XL/3500XL/2950 terminology. Reflector Port-A port that copies packets onto an RSPAN VLAN. Source (SPAN) VLAN-A VLAN whose traffic is monitored with use of the SPAN feature.ĭestination (SPAN) port-A port that monitors source ports, usually where a network analyzer is connected. Source (SPAN) port-A port that is monitored with use of the SPAN feature. Ingress traffic-Traffic that enters the switch.Įgress traffic-Traffic that leaves the switch. The other sections of this document describe how you can tune this feature very precisely in order to do more than just monitor a port. In this diagram, the sniffer is attached to a port that is configured to receive a copy of every packet that host A sends. The switch floods the packets to all the ports in the destination VLAN.Īn extra feature is necessary that artificially copies unicast packets that host A sends to the sniffer port: The switch does not know where to send the traffic. Unicast flooding occurs when the switch does not have the destination MAC in its content-addressable memory (CAM) table. Multicast traffic with CGMP or Internet Group Management Protocol (IGMP) snooping disabled In this configuration, the sniffer only captures traffic that is flooded to all ports, such as: Therefore, the sniffer does not see this traffic: On a switch, after the host B MAC address is learned, unicast traffic from A to B is only forwarded to the B port. All other ports see the traffic between hosts A and B: After this forwarding table is built, the switch forwards traffic that is destined for a MAC address directly to the corresponding port.įor example, to capture Ethernet traffic that is sent by host A to host B, and both are connected to a hub, just attach a sniffer to this hub. When a hub receives a packet on one port, the hub sends out a copy of that packet on all ports except on the one where the hub received the packet.Īfter a switch boots, it starts to build up a Layer 2 forwarding table on the basis of the source MAC address of the different packets that the switch receives. The SPAN feature was introduced on switches because of a fundamental difference that switches have with hubs. What are the different features available (especially multiple, simultaneous SPAN sessions), and what software level is necessary in order to run them? What is SPAN and how do you configure it? This document answers the most common questions about SPAN, such as: This document is not intended to be an alternate configuration guide for the SPAN feature. However, the latest releases of the Catalyst OS (CatOS) introduced great enhancements and many new possibilities that are now available to the user. Previously, SPAN was a relatively basic feature on the Cisco Catalyst Series switches. The network analyzer can be a Cisco SwitchProbe device or other Remote Monitoring (RMON) probe. The SPAN feature, which is sometimes called port mirroring or port monitoring, selects network traffic for analysis by a network analyzer. If your network is live, ensure that you understand the potential impact of any command. All of the devices used in this document started with a cleared (default) configuration. The information in this document was created from the devices in a specific lab environment. On the Catalyst 2900XL/3500XL Series Switches, Cisco IOS ® Software Release 12.0(5)XU is used.Īlthough this document is updated to reflect changes to SPAN, refer to your switch platform documentation release notes for the latest developments on the SPAN feature. This information in this document uses CatOS 5.5 as a reference for the Catalyst 4500/4000, 5500/5000, and 6500/6000 Series Switches. There are no specific requirements for this document. Supervisor 720 with PFC3A that has hardware version 3.2 or later and running Cisco IOS Software Release 12.2(18)SXE or laterĬatalyst 4500/4000 Series (includes 4912G) Yes Supervisor 2T with PFC4, Supervisor 720 with PFC3B or PFC3BXL running Cisco IOS Software Release 12.2(18)SXE or later. Prerequisites Catalyst Switches That Support SPAN, RSPAN, and ERSPAN Catalyst Switches This document describes the recent features of the Switched Port Analyzer (SPAN) that have been implemented.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |