Local SPAN and Remote SPAN (RSPAN) Explained [Step by Step]
Contents
What is Local SPAN (Switched Port Analyzer)
SPAN (switched port analyzer) is the port mirroring function of Cisco Ethernet switches. This makes it possible to copy on a given port the traffic destined for one or more other ports.
Port mirroring (or Local SPAN) is used on a switch (or router) to send a copy of network packets seen on one source switch port (or a VLAN) to a network monitoring Analyzer on a destination switch port. This is commonly used for network appliances that require monitoring of network traffic such as an intrusion detection system.
A network analyzer such as Wireshark connected to the SPAN Destination port can monitor traffic coming from any of the switch ports.
This function makes it possible to carry out traffic analyzes without disturbing the operation of the observed network.
Local SPAN topology:
Local SPAN Configuration [Cisco Switches and Routers]
For local SPAN configuration, Please refer to the following articles:
* Cisco Switched Port Analyzer (SPAN) Configuration Example
What is Remote SPAN or RSPAN (Remote Switched Port Analyzer)
RSPAN Topology
Remote SPAN – RSPAN Configuration [Cisco Switches and Routers]
For local SPAN configuration, Please refer to the following article:
Local SPAN vs Remote SPAN
- Local SPAN: The SPAN feature is local when the monitored ports are all located on the same switch as the destination port. This feature is in contrast to Remote SPAN (RSPAN), which this list also defines.
- Remote SPAN (RSPAN): Some source ports are not located on the same switch as the destination port. RSPAN is an advanced feature that requires a special VLAN to carry the traffic that is monitored by SPAN between switches. RSPAN is not supported on all switches. Check the respective release notes or configuration guide to see if you can use RSPAN on the switch that you deploy.
