Vlan-Based Span; Span Traffic - Cisco 2950G 24 - Catalyst Switch Software Configuration Manual

Understanding SPAN and RSPAN
•
•
If the bandwidth of the reflector port is not sufficient to handle the traffic from the corresponding source
ports and VLANs, the excess packets are dropped. A 10/100 port reflects at 100 Mbps. A Gigabit port
reflects at 1 Gbps.

VLAN-Based SPAN

VLAN-based SPAN (VSPAN) is the monitoring of the network traffic in one or more VLANs. You can
configure VSPAN to monitor only received (Rx) traffic, which applies to all the ports for that VLAN.
Use these guidelines for VSPAN sessions:
•
•
•
•
•
•
•

SPAN Traffic

You can use local SPAN to monitor all network traffic, including multicast and bridge protocol data unit
(BPDU) packets, and Cisco Discovery Protocol (CDP), VLAN Trunk Protocol (VTP), Dynamic
Trunking Protocol (DTP), Spanning Tree Protocol (STP), and Port Aggregation Protocol (PagP) packets.
You cannot use RSPAN to monitor Layer 2 protocols. See the
section on page 21-14
In some SPAN configurations, multiple copies of the same source packet are sent to the SPAN
destination port. For example, a bidirectional (both Rx and Tx) SPAN session is configured for the
sources a1 Rx monitor and the a2 Rx and Tx monitor to destination port d1. If a packet enters the switch
through a1 and is switched to a2, both incoming and outgoing packets are sent to destination port d1.
Both packets are the same (unless a Layer-3 rewrite occurs, in which case the packets are different
because of the added Layer 3 information).
Catalyst 2950 Desktop Switch Software Configuration Guide
21-6
Spanning tree is automatically disabled on a reflector port.
A reflector port receives copies of sent and received traffic for all monitored source ports. If a
reflector port is oversubscribed, it could become congested. This could affect traffic forwarding on
one or more of the source ports.
Only traffic on the monitored VLAN is sent to the destination port.
If a destination port belongs to a source VLAN, it is excluded from the source list and is not
monitored.
If ports are added to or removed from the source VLANs, the traffic on the source VLAN received
by those ports is added to or removed from the sources being monitored.
VLAN pruning and the VLAN allowed list have no effect on SPAN monitoring.
VSPAN only monitors traffic that enters the switch, not traffic that is routed between VLANs. For
example, if a VLAN is being Rx-monitored and the multilayer switch routes traffic from another
VLAN to the monitored VLAN, that traffic is not monitored and is not received on the SPAN
destination port.
You cannot use filter VLANs in the same session with VLAN sources.
You can monitor only Ethernet VLANs.
for more information.
Chapter 21 Configuring SPAN and RSPAN
"RSPAN Configuration Guidelines"
78-14982-01