Cisco Switched Port Analyzer (SPAN) Configuration Example

Topology

Switched Port Analyzer (SPAN) Configuration

The Switched Port Analyzer (SPAN) feature (sometimes called port mirroring or port monitoring)
selects network traffic for analysis by a network analyzer. The network analyzer can be a Cisco
SwitchProbe, a Fibre Channel Analyzer.

Create a SPAN monitor session and specify the source and destination:

Configure SPAN Source:

Switch(config)#monitor session 1 source interface Fa0/1 ?
  ,     comma
  -     hyphen
  both  SPAN copies both egress and ingress traffic
  rx    SPAN copies only ingress traffic
  tx    SPAN copies only egress traffic
  <cr>
Switch(config)#monitor session 1 source interface Fa0/1

• Ingress source (Rx): Traffic entering the switch through this source port is copied to the SPAN
  destination port.
• Egress source (Tx): Traffic exiting the switch through this source port is copied to the SPAN
  destination port.

Configure SPAN Destination:

monitor session 1 destination interface Fa0/2

Full Configuration:

monitor session 1 source interface Fa0/1 both
monitor session 1 destination interface Fa0/2

SPAN Capture and verification

We will create an interface VLAN in the switch, that we will use to ping from the PC:

interface Vlan1
 ip address 172.31.120.254 255.255.255.0

We start a ping from the PC to the interface VLAN:

Check the capture in the Sniffer:

Delete a SPAN monitor session

we just need to add “no” keyword and specify the id of the monitor session to delete:

Switch(config)#no monitor session 1