Spanning Ports

[mjgoodman]

In Cisco IOS on a switch you can do a 'monitor session.....'. There are options for spanning and monitoring a port's traffic or the traffic from a VLAN. Obviously the main difference is that one allows the ability to see all VLAN traffic for a particular VLAN but what are the other differences?

When I tried this before with a Sniffer application, I specified a source and destination. I tried it by spanning the vlan and by port and I got different information. What is the difference?

Any URL links would be appreciated.

[dgahm · Accepted solution]

Michael,

When you SPAN a VLAN you are selecting all of the ports assigned to that VLAN. A show monitor session for a VLAN SPAN will list the actual source ports in that VLAN. So you could SPAN the same traffic by entering the list of ports, it's just a lot easier to specify the VLAN.

When you SPAN a VLAN you will often capture the same packets twice, since they are received on one port and transmitted on another port you are SPANing. By selecting RX only you can avoid this. On older IOS RX was the only choice for VLANs, but with newer code Both is the default.

http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_chapter09186a00803fb0ce.html

Please rate helpful posts.

Dave

[eofelt]

Some SPAN Terminology...

Source (SPAN) port ?A port that is monitored with use of the SPAN feature.

Source (SPAN) VLAN ?A VLAN whose traffic is monitored with use of the SPAN feature.

Destination (SPAN) port ?A port that monitors source ports, usually where a network analyzer is connected.

Reflector Port ?A port that copies packets onto an RSPAN VLAN.

Monitor port?A monitor port is also a destination SPAN port in Catalyst 2900XL/3500XL/2950 terminology.

A particular SPAN session can either monitor VLANs or monitor individual interfaces?you cannot have a SPAN session that monitors both specific interfaces and specific VLANs.

If you will, read the following link which

should explain fairly well. If you have more questions, please post away.

http://www.cisco.com/warp/public/473/41.html

HTH for now