In Cisco IOS on a switch you can do a 'monitor session.....'. There are options for spanning and monitoring a port's traffic or the traffic from a VLAN. Obviously the main difference is that one allows the ability to see all VLAN traffic for a particular VLAN but what are the other differences?
When I tried this before with a Sniffer application, I specified a source and destination. I tried it by spanning the vlan and by port and I got different information. What is the difference?
Any URL links would be appreciated.
When you SPAN a VLAN you are selecting all of the ports assigned to that VLAN. A show monitor session for a VLAN SPAN will list the actual source ports in that VLAN. So you could SPAN the same traffic by entering the list of ports, it's just a lot easier to specify the VLAN.
When you SPAN a VLAN you will often capture the same packets twice, since they are received on one port and transmitted on another port you are SPANing. By selecting RX only you can avoid this. On older IOS RX was the only choice for VLANs, but with newer code Both is the default.
Please rate helpful posts.