Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Trunk port as a destination for SPAN session

Can we make a trunk port as a destination for SPAN session? If yes, how
Everyone's tags (1)
New Member

Of course you can. It will be

Of course you can. It will be configured the same as an access port:

monitor session 1 destination int g0/24

However be aware of the following:

Destination Port

Each local SPAN session destination session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source port.

The destination port has these characteristics:

It must reside on the same switch as the source port (for a local SPAN session).

It can be any Ethernet physical port.

It cannot be a source port or a reflector port.

It cannot be an EtherChannel group or a VLAN.

It can be a physical port that is assigned to an EtherChannel group, even if the EtherChannel group has been specified as a SPAN source. The port is removed from the group while it is configured as a SPAN destination port.

The port does not transmit any traffic except that required for the SPAN session.

If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic at Layer 2.

It does not participate in spanning tree while the SPAN session is active.

When it is a destination port, it does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP, or LACP).

No address learning occurs on the destination port.

A destination port receives copies of sent and received traffic for all monitored source ports. If a destination port is oversubscribed, it could become congested. This could affect traffic forwarding on one or more of the source ports.

Well, if i did so, the trunk

Well, if i did so, the trunk port will goes into "monitoring" mode and i will loose the connectivity to other switches that connects to the trunk port, 


So how i configure the trunk port as SPAN destination while i keep the connectivity to other switches through this port active?


one more thing i would like

one more thing i would like to add.

If the monitor session destination port is a trunk, you should also use keyword ‘encapsulation dot1q’. If you do not, packets will be sent on the interface in native format.

c3550(config)#monitor session 1 destination interface fa0/24 encapsulation dot1q

If you configure a SPAN destination as a trunk port, it will be able to capture all vlan tagged data.

"Please rate helpful posts"

CreatePlease to create content