Cisco IOS Configure Span Ports

## Introduction

Cisco Catalyst switches can use the Switched Port Analyzer (SPAN) feature to mirror traffic from one source port or VLAN to a destination port. This allows a monitoring device, such as a network analyzer or "Sniffer", to be attached to the destiantion port for capturing traffic.

WHen packets arrive on the source port or VLAN, they are specifically marked so that they can be copied to the SPAN destination port as they are delivered to the normal destination port. In this way, the packet capture receives an exact copy of the packets that are being forwarded to and from the SPAN souirce .

Span is available in two different forms:

* **Local SPAN:** Both the SPAN source and destination are located on the local switch the source in one or more switch ports.
* **Remote SPAN(RSPAN):** The SPAN source and destination are located on different switches. Mirrored traffic is copied over a special-purpose VLAN across trunks between Switches from the source to the destination

## Situation

We are going to create three SPAN sessions:

* A Local SPAN session that copies traffic from uplink interface (Fa0/1)

* A Local SPAN session that copies traffic from the IP phone vlan 300

* A Remote SPAN session That copies traffic from the internet uplink interface on the core switch to the closet swtich.

## Local SPAN from Uplink Interface

We are going to configure a SPAN session that copies traffic from the Fa0/1 which is an uplink to our core switch to our local interface Fa0/47. Use the following commands

* Config T
* Monitor Session 1 source interface FastEthernet 0/1 Both
* Monitor Session 1 destination interface FastEthernet 0/47

After this you should start receiving traffic to your network analyzer on Fa0/47

## Local SPAN from Vlan

We are going to configure a SPAN session that copies traffic from VLAN 300 to our local interface Fa0/48. Use the Following commands

* Config T
* Monitor Session 2 source vlan 300 both
* Monitor Session 2 Destination interface Fa0/48

After this you should start receiving traffic to your network analyzer on Fa0/48

## Verify your Span Sessions

you can use the command **Show monitor Session all** to show all of your configured sessions

## Remote Span Quick Review

In larger networks that have a larger more complex switch fabric it may not be advantageous to go to a particular switch and configure a Local SPAN port, there may also be security concerns with leaving your network analyzer connected in a disperate closet on your campus away from your office.

Remote span takes advantage of the trunk connections between switches to send span traffic from a source swtich port or VLAN to a destinaion switch / port

## Detailed Steps

### Add Remote Span Vlan

Use the following Commands to add a remote SPAN vlan to the switch, please note that if you are not using Virtual Trunking Protocol (VTP) to replicate VLANs between swtiches then you will have to create the RSPAN VLAN on each switch in the path between the SPAN source and destination

* Config T
* Vlan *Vlan-id*
	+ i.e. Vlan 310
* remote SPAN
* end

### Add RSPAN Vlan to Trunk

Please note that if you are using the default configuration of trunks between swtiches then you can skip this step, but if you are limiting what Vlan can travel over what trunk the you will have to add the VLAN to the trunk links with the following commands

* config t
* interface name and number for the uplink
	+ i.e. Interface FastEthernet 0/24
* switchport trunk allowed vlan add *vlan-id*
	+ i.e. switchport trunk allowed vlan add 310
* end

### Configure RSPAN on Source Switch

Use the following commands on the source switch to setup the Monitoring Session

* Config T
* Monitor Session *Session-number* source (interface or Vlan) RX or TX or Both
	+ I.e. Monitor Session 3 Source interface fa0/23 both
* Monitor Session *Session-number* destination remote vlan *rspan-vlan-id*
	+ i.e Monitor Session 3 destination remote vlan 310

### Configure RSPAN on Destination

Use the following commands to setup RSPAN on the destination switch

* Config t
* Monitor Session *Session number* source remote Vlan *rspan vlan id*
	+ Monitor Session 3 Source remote vlan 310
* Monitor Session *Session number* destination interface name and number
	+ Monitor Session 3 Destination interface fa0/46
* end

you should now be capturing traffic on your destination switch.