Switch Port Analyzer (SPAN) is a mechanism which provide port/vlan analyze by mirroring one port/vlan traffic to another. There are three types SPAN. These are: Local SPAN (SPAN), Remote SPAN (RSPAN) and Encapsulated Remote SPAN (ERSPAN). Local SPAN is the SPAN type in which, both source and destination ports reside in the same switch. In this lesson, we will see Local SPAN Configuration on Cisco switches. We will practice this example on Cisco Packet Tracer.
For our Local SPAN Configuration, we will use the below simple topology. As you can see there is a switch and there are two PCs are connected to it.
Here, our aim is mirroring one port’s traffic to another port. By doing this, we can analyze the mirrored source port’s traffic at the destination port.
We will configure Local SPAN in three steps:
Now, let’s start our Local SPAN Configuration Example.
SPAN Source Port is the port which is the port that will be mirrored and analyzed. The first step here, is configuring this source port. Our source port is Fast Ethernet 0/1. To set it as a Local SPAN Source Port, we will use “monitor session 1 source interface fa0/1” Cisco command on our Cisco switch.
Switch# configure terminal Switch(config)# monitor session 1 source interface fa0/1
As a SPAN source, a VLAN can be also used like below. Thisn about that, we will mirror VLAN 5.
Switch(config)# monitor session 1 source vlan 5
Here, according to your configuration, you can use a VLAN filter that shows only selected VLANs. For example if we would like to monitor only VLAN 1 to VLAN 10, we will use the below command:
Switch(config)# monitor session 1 filter vlan 1 – 10
After this configuration, we will forward only the selected VLANs (VLAN 1 to 10).
In this step, we will configure only normal port as source port for our Cisco Packet Tracer example.