Question about number of source interfaces a span session can support.

Answered Question
Sep 13th, 2010
User Badges:

Hi,


I need help to know how many source interface can a SPAN support for 3560 series and 3750 series.

Can these two models support 5 source ports per session?

I tried referring to cisco datasheets they only say the switches support SPAN and RSPAN but never states the number of source interfaces that a session can support.

I need this information to be able to suggest a L3 switch model.

My current 3550 can only monitor one source interface per session.


Thanks.

Correct Answer by glen.grant about 6 years 10 months ago

   Just keep in mind the total amount of traffic coming from those source ports should not be more than the monitor port or that traffic will just get dropped and what you are using the span port for ,  (packet analyzer etc.. ) will be less than accurate.

Correct Answer by Justin Brenton about 6 years 10 months ago

That's right, you can use as many source ports,vlans as the switch can handle.


Also the switch supports a maximum of two  sessions (local or RSPAN) with source ports or VLANs, and you cannot mix  ports and VLANs in a single session.


http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_46_se/configuration/guide/swspan.html#wp1044603



Regards,

Justin

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.3 (3 ratings)
Loading.
Justin Brenton Mon, 09/13/2010 - 20:08
User Badges:
  • Silver, 250 points or more

Characteristics of Source Port

A source port, also called a monitored port, is a switched or routed       port that you monitor for network traffic analysis. In a single local SPAN       session or RSPAN source session, you can monitor source port traffic, such as       received (Rx), transmitted (Tx), or bidirectional (both). The switch supports       any number of source ports (up to the maximum number of available ports on the       switch) and any number of source VLANs.

A source port has these characteristics:

  • It can be any port type, such as EtherChannel, Fast Ethernet, Gigabit           Ethernet, and so forth.

  • It can be monitored in multiple SPAN sessions.

  • It cannot be a destination port.

  • Each source port can be configured with a direction (ingress, egress,           or both) to monitor. For EtherChannel sources, the monitored direction applies           to all physical ports in the group.

  • Source ports can be in the same or different VLANs.

  • For VLAN SPAN sources, all active ports in the source VLAN are           included as source ports.


From this doc:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#charac_source


HTH, Please rate if so


Justin

rakyomin78 Mon, 09/13/2010 - 20:13
User Badges:

Hi,


Thanks for your reply.

The sentence highlighted in red did not explicitly specify how many source interfaces can one destination port monitor per session.

This is my switch:

3550-1(config)#monitor session 1 source interface fa0/21 - 24 both
% This platform allows a maximum of 1 TX monitor interface(s)


Is it safe to say 3560 and 3750 are able to support as many source ports as I like per span session and per destination port? (exclude the traffic congestion part) Thanks again.

Correct Answer
Justin Brenton Mon, 09/13/2010 - 20:24
User Badges:
  • Silver, 250 points or more

That's right, you can use as many source ports,vlans as the switch can handle.


Also the switch supports a maximum of two  sessions (local or RSPAN) with source ports or VLANs, and you cannot mix  ports and VLANs in a single session.


http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_46_se/configuration/guide/swspan.html#wp1044603



Regards,

Justin

Correct Answer
glen.grant Tue, 09/14/2010 - 04:50
User Badges:
  • Purple, 4500 points or more

   Just keep in mind the total amount of traffic coming from those source ports should not be more than the monitor port or that traffic will just get dropped and what you are using the span port for ,  (packet analyzer etc.. ) will be less than accurate.

rakyomin78 Tue, 09/14/2010 - 06:38
User Badges:

Thanks Glen. I do aware of that. However I am still in doubt... I can have as many source port as I want.. but can they all be monitor for ingress and egress packets? I mean both directions....

Actions

This Discussion