Source Port; Destination Port - Cisco Catalyst 2950 Software Configuration Manual

Chapter 20 Configuring SPAN
•
•

Source Port

A source port (also called a monitored port) is a switched port that you monitor for network traffic
analysis. In a single SPAN session, you can monitor source port traffic such as received (Rx), transmitted
(Tx), or bidirectional (both). The switch supports any number of source ports (up to the maximum
number of available ports on the switch).
A source port has these characteristics:
•
•
•
•
You can configure a trunk port as a source port. All VLANs active on the trunk are monitored on a trunk
source port.

Destination Port

A SPAN session must have a destination port (also called a monitoring port) that receives a copy of
traffic from the source port.
The destination port has these characteristics:
•
•
•
78-11380-04
Packets that are modified because of quality of service (QoS)—for example, modified Differentiated
Services Code Point (DSCP)—are copied with modification for Rx SPAN.
Some features that can cause a packet to be dropped during receive processing have no effect on
SPAN; the destination port receives a copy of the packet even if the actual incoming packet is
dropped. These features include IP standard and extended input access control lists (ACLs) and IP
standard and extended output ACLs for unicast and ingress QoS policing. Switch congestion that
causes packets to be dropped also has no effect on SPAN.
Transmit (Tx) SPAN—The goal of transmit (or egress) SPAN is to monitor as much as possible all
the packets sent by the source interface after all modification and processing is performed by the
switch. A copy of each packet sent by the source is sent to the destination port for that SPAN session.
The copy is provided after the packet is modified. You can monitor a range of egress ports in a SPAN
session.
On packets that are modified because of QoS, the modified packet might not have the same DSCP
(IP packet) or CoS (non-IP packet) as the SPAN source.
Some features that can cause a packet to be dropped during transmit processing might also affect the
duplicated copy for SPAN. These features include IP standard and extended output ACLs on
multicast packets and egress QoS policing. In the case of output ACLs, if the SPAN source drops
the packet, the SPAN destination would also drop the packet. If the source port is oversubscribed,
the destination ports will have different dropping behavior.
Both—In a SPAN session, a series or range of ports can be monitored for both received and sent
packets.
It can be any port type (for example, EtherChannel, Fast Ethernet, Gigabit Ethernet, and so forth).
It cannot be a destination port.
Each source port can be configured with a direction (ingress, egress, or both) to monitor. For
EtherChannel sources, the monitored direction would apply to all the physical ports in the group.
Source ports can be in the same or different VLANs.
It must reside on the same switch as the source port.
It can be any Ethernet physical port.
It cannot be a source port.
Catalyst 2950 Desktop Switch Software Configuration Guide
Understanding SPAN
20-3