×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Spanning Ports

Answered Question
May 2nd, 2007
User Badges:

In Cisco IOS on a switch you can do a 'monitor session.....'. There are options for spanning and monitoring a port's traffic or the traffic from a VLAN. Obviously the main difference is that one allows the ability to see all VLAN traffic for a particular VLAN but what are the other differences?


When I tried this before with a Sniffer application, I specified a source and destination. I tried it by spanning the vlan and by port and I got different information. What is the difference?


Any URL links would be appreciated.

Correct Answer by dgahm about 10 years 3 months ago

Michael,

When you SPAN a VLAN you are selecting all of the ports assigned to that VLAN. A show monitor session for a VLAN SPAN will list the actual source ports in that VLAN. So you could SPAN the same traffic by entering the list of ports, it's just a lot easier to specify the VLAN.


When you SPAN a VLAN you will often capture the same packets twice, since they are received on one port and transmitted on another port you are SPANing. By selecting RX only you can avoid this. On older IOS RX was the only choice for VLANs, but with newer code Both is the default.


http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_chapter09186a00803fb0ce.html


Please rate helpful posts.


Dave

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
dgahm Wed, 05/02/2007 - 14:02
User Badges:
  • Blue, 1500 points or more

Michael,

When you SPAN a VLAN you are selecting all of the ports assigned to that VLAN. A show monitor session for a VLAN SPAN will list the actual source ports in that VLAN. So you could SPAN the same traffic by entering the list of ports, it's just a lot easier to specify the VLAN.


When you SPAN a VLAN you will often capture the same packets twice, since they are received on one port and transmitted on another port you are SPANing. By selecting RX only you can avoid this. On older IOS RX was the only choice for VLANs, but with newer code Both is the default.


http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_chapter09186a00803fb0ce.html


Please rate helpful posts.


Dave

eofelt Wed, 05/02/2007 - 14:14
User Badges:
  • Bronze, 100 points or more

Some SPAN Terminology...


Source (SPAN) port ?A port that is monitored with use of the SPAN feature.


Source (SPAN) VLAN ?A VLAN whose traffic is monitored with use of the SPAN feature.


Destination (SPAN) port ?A port that monitors source ports, usually where a network analyzer is connected.


Reflector Port ?A port that copies packets onto an RSPAN VLAN.


Monitor port?A monitor port is also a destination SPAN port in Catalyst 2900XL/3500XL/2950 terminology.


A particular SPAN session can either monitor VLANs or monitor individual interfaces?you cannot have a SPAN session that monitors both specific interfaces and specific VLANs.


If you will, read the following link which

should explain fairly well. If you have more questions, please post away.


http://www.cisco.com/warp/public/473/41.html



HTH for now

Actions

This Discussion