Solved: Question about number of source interfaces a span session can support.

rakyomin78 · ‎09-13-2010

Hi,

I need help to know how many source interface can a SPAN support for 3560 series and 3750 series.

Can these two models support 5 source ports per session?

I tried referring to cisco datasheets they only say the switches support SPAN and RSPAN but never states the number of source interfaces that a session can support.

I need this information to be able to suggest a L3 switch model.

My current 3550 can only monitor one source interface per session.

Thanks.

Justin Brenton · ‎09-13-2010

That's right, you can use as many source ports,vlans as the switch can handle.

Also the switch supports a maximum of two sessions (local or RSPAN) with source ports or VLANs, and you cannot mix ports and VLANs in a single session.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_46_se/configuration/guide/swspan.html#wp1044603

Regards,

Justin

View solution in original post

glen.grant · ‎09-14-2010

Just keep in mind the total amount of traffic coming from those source ports should not be more than the monitor port or that traffic will just get dropped and what you are using the span port for , (packet analyzer etc.. ) will be less than accurate.

View solution in original post

Justin Brenton · ‎09-13-2010

Characteristics of Source Port

A source port, also called a monitored port, is a switched or routed port that you monitor for network traffic analysis. In a single local SPAN session or RSPAN source session, you can monitor source port traffic, such as received (Rx), transmitted (Tx), or bidirectional (both). The switch supports any number of source ports (up to the maximum number of available ports on the switch) and any number of source VLANs.

A source port has these characteristics:

It can be any port type, such as EtherChannel, Fast Ethernet, Gigabit Ethernet, and so forth.
It can be monitored in multiple SPAN sessions.
It cannot be a destination port.
Each source port can be configured with a direction (ingress, egress, or both) to monitor. For EtherChannel sources, the monitored direction applies to all physical ports in the group.
Source ports can be in the same or different VLANs.
For VLAN SPAN sources, all active ports in the source VLAN are included as source ports.

From this doc:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#charac_source

HTH, Please rate if so

Justin

rakyomin78 · ‎09-13-2010

Hi,

Thanks for your reply.

The sentence highlighted in red did not explicitly specify how many source interfaces can one destination port monitor per session.

This is my switch:

3550-1(config)#monitor session 1 source interface fa0/21 - 24 both
% This platform allows a maximum of 1 TX monitor interface(s)

Is it safe to say 3560 and 3750 are able to support as many source ports as I like per span session and per destination port? (exclude the traffic congestion part) Thanks again.

Justin Brenton · ‎09-13-2010

That's right, you can use as many source ports,vlans as the switch can handle.

Also the switch supports a maximum of two sessions (local or RSPAN) with source ports or VLANs, and you cannot mix ports and VLANs in a single session.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_46_se/configuration/guide/swspan.html#wp1044603

Regards,

Justin

glen.grant · ‎09-14-2010

Just keep in mind the total amount of traffic coming from those source ports should not be more than the monitor port or that traffic will just get dropped and what you are using the span port for , (packet analyzer etc.. ) will be less than accurate.

rakyomin78 · ‎09-14-2010

Thanks Glen. I do aware of that. However I am still in doubt... I can have as many source port as I want.. but can they all be monitor for ingress and egress packets? I mean both directions....