Cisco SPAN Overview

Cisco SPAN Overview

SPAN  (Local Switched Port Analyzer) is used to monitor specific souce ports’ or specific VLANs traffic, mirror this traffic and then sends the traffic to a destination port on Cisco switches and Cisco routers. SPAN is used generally for troubleshooting and monitoring activities on the Cisco devices. After getting the copies of the ports or VLANs traffic, at the destination, an analyzer analyses this traffic.

There are three types Cisco SPANs on Cisco devices. These SPANs are :

• Local SPAN (SPAN)
• Remote SPAN (RSPAN)
• Encapsualted Remote SPAN (ERSPAN)

Now, let’s talk about these SPAN types one by one detailly.

What is Local SPAN (SPAN) ?

If Cisco SPAN is configured on a single Cisco switch, this local mirroring is called Local SPAN. In other words, if your session and the desatination ports are in the same switch (they are local together), this Cisco SPAN is Local SPAN. Everything in Local SPAN, occurs at the same switch.

Think about the below switch shape. Here, Cisco SPAN Ports are Port 2 and port 18. Port 2 is the Cisco SPAN Port as source and Port 18 is the Cisco SPAN Port as destination.

Local SPAN can has multiple ports or multiple VLANs as SPAN source. But at the same time, you can not use both of them for a SPAN session. In the following lessons, we will see How to Configure Local SPAN on Cisco devices.

What is Remote SPAN (RSPAN) ?

Remote SPAN (RSPAN) is the Cisco SPAN type that is used between different switches. Here, source ports or VLANs can reside on a Cisco switch and the destination ports can be on another Cisco switch. Port or VLAN Mirroring are done among  the switches.

On Cisco Remote SPAN, the traffic is carried over Layer 2 (Data Link Layer). To carry the traffic of Cisco RSPAN Session, a specific RSPAN VLAN is used between switches and all the switches should connected via trunk interfaces.

In the above lan topology,  on different swicthes you can see Cisco SPAN Ports. Port 3 on Switch C is the Cisco SPAN port as SPAN source and Port 4 on Switch A is the Cisco SPAN Port as SPAN destination.

Cisco Remote SPAN(RSPAN) can has multiple ports or multiple VLANs as SPAN source. But at the same time, you can not use both of them for a Cisco SPAN session. This is similar to Local SPAN. In the other lessons, we will configure Remote SPAN on Cisco Devices.

What is Encapsualted Remote SPAN (ERSPAN) ?

Encapsulated Remote SPAN(ERSPAN) is the Cisco SPAN type used between the switches over Layer 3, over GRE encapsulation. Here, source and destination ports, VLANs  are in the diffent switches like RSPAN. The main difference between these Cisco SPAN types is the connection between the switches.

Become a Member!