Filter
Top Products
20-3
Catalyst 2940 Switch Software Configuration Guide
78-15507-02
Chapter 20 Configuring SPAN
Understanding SPAN
Traffic Types
SPAN sessions include these traffic types:
• Receive (Rx) SPAN—The goal of receive (or ingress) SPAN is to monitor as much as possible all
the packets received by the source interface. A copy of each packet received by the source is sent to
the destination port for that SPAN session. You can monitor a series or range of ingress ports in a
SPAN session.
At the destination port, if tagging is enabled, the packets appear with the 802.1Q header. If no
tagging is specified, packets appear in the native format.
Packets that are modified because of quality of service (QoS) are copied with modification for Rx
SPAN.
• Transmit (Tx) SPAN—The goal of transmit (or egress) SPAN is to monitor as much as possible all
the packets sent by the source interface after all modification and processing is performed by the
switch. A copy of each packet sent by the source is sent to the destination port for that SPAN session.
The copy is provided after the packet is modified. You can monitor a range of egress ports in a SPAN
session.
For packets that are modified because of QoS, the modified packet might not have the same CoS
(non-IP packet) as the SPAN source.
Some features that can cause a packet to be dropped during transmit processing might also affect the
duplicated copy for SPAN. If the source port is oversubscribed, the destination ports will have
different dropping behavior.
• Both—In a SPAN session, you can monitor a series or range of ports for both received and sent
packets.
Source Port
A source port (also called a monitored port) is a switched port that you monitor for network traffic
analysis. In a single local SPAN session, you can monitor source port traffic such as received (Rx),
transmitted (Tx), or bidirectional (both). The switch supports any number of source ports (up to the
maximum number of available ports on the switch).
A source port has these characteristics:
• It can be any port type (for example, EtherChannel, Fast Ethernet, Gigabit Ethernet, and so forth).
• It cannot be a destination port.
• Each source port can be configured with a direction (ingress, egress, or both) to monitor. For
EtherChannel sources, the monitored direction would apply to all the physical ports in the group.
• Source ports can be in the same or different VLANs.
You can configure a trunk port as a source port. All VLANs active on the trunk are monitored.
Destination Port
Each local SPAN session destination session must have a destination port (also called a monitoring port)
that receives a copy of traffic from the source port.
The destination port has these characteristics:
• It must reside on the same switch as the source port (for a local SPAN session).
• It can be any Ethernet physical port.