Cisco Switched Port Analyzer (SPAN) Configuration Example
![Cisco Switched Port Analyzer (SPAN) Configuration Example](https://learnduty.com/wp-content/uploads/2022/04/image-1.png)
Contents
Topology
![](https://learnduty.com/wp-content/uploads/2022/04/image-1.png)
Switched Port Analyzer (SPAN) Configuration
The Switched Port Analyzer (SPAN) feature (sometimes called port mirroring or port monitoring)
selects network traffic for analysis by a network analyzer. The network analyzer can be a Cisco
SwitchProbe, a Fibre Channel Analyzer.
Create a SPAN monitor session and specify the source and destination:
Configure SPAN Source:
Switch(config)#monitor session 1 source interface Fa0/1 ?
, comma
- hyphen
both SPAN copies both egress and ingress traffic
rx SPAN copies only ingress traffic
tx SPAN copies only egress traffic
<cr>
Switch(config)#monitor session 1 source interface Fa0/1
- Ingress source (Rx): Traffic entering the switch through this source port is copied to the SPAN
destination port. - Egress source (Tx): Traffic exiting the switch through this source port is copied to the SPAN
destination port.
Configure SPAN Destination:
monitor session 1 destination interface Fa0/2
Full Configuration:
monitor session 1 source interface Fa0/1 both
monitor session 1 destination interface Fa0/2
SPAN Capture and verification
We will create an interface VLAN in the switch, that we will use to ping from the PC:
interface Vlan1
ip address 172.31.120.254 255.255.255.0
We start a ping from the PC to the interface VLAN:
![](https://learnduty.com/wp-content/uploads/2022/04/image-2.png)
Check the capture in the Sniffer:
![](https://learnduty.com/wp-content/uploads/2022/04/image-3-645x628.png)
Delete a SPAN monitor session
we just need to add “no” keyword and specify the id of the monitor session to delete:
Switch(config)#no monitor session 1