Capturing traffic in a switched network

In order to collect data traffic on a switched network, special configuration of a switch port where a network analyzer will be attached is necessary.

Issue of Capturing Data in a Switched Network
Before switches were so prevalent in a network, collecting a sample of network traffic was relatively simple. A network analyzer could be plugged into any free port on a hub to capture all data frames on the shared segment because all frames were forwarded out all hub ports. In a switched network, frames are usually isolated to only the switch ports where the sending and receiving devices are located. This makes collecting an overall sample of data on a network segment more challenging.

If a network analyzer is connected to a switch port, by default the analyzer will only collect data directed to the MAC address of the analyzer, and any broadcast, multicast or unicast flooding traffic forwarded out that switch port.

To resolve this issue, Cisco switches allow one or more ports to be configured as Switch Port Analyzer (SPAN) ports. SPAN sends a copy of frames generated on one port or an entire VLAN to another switch port hosting a network analyzer. The concept of SPAN is also referred to as Port Mirroring or Port Monitoring.

Commands Used to Facilitate Capturing Network Traffic
Various commands are used across Catalyst platforms to inform the switch which port carries the traffic of interest and to which port the network analyzer will be attached.

Here are three common commands used to invoke SPAN on various Catalyst Platforms.

Monitoring Performance with RSPAN
Remote SPAN (RSPAN) is a variation of SPAN. Rather than sending traffic directly to the traffic analyzer located on the same switch as the port being monitored, RSPAN sends traffic from a monitored port through an intermediate switch network to a traffic analyzer on another switch. RSPAN supports source ports, source VLANs, and destination ports on different switches. RSPAN provides remote monitoring of ports on multiple switches across the network, as shown in Figure . The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches.

RSPAN consists of an RSPAN source session, an RSPAN VLAN, and an RSPAN destination session. The RSPAN source session must be configured separately from the destination sessions given that the two are on different network devices. To configure an RSPAN source session on one network device, associate a set of source ports and VLANs with an RSPAN VLAN. To configure an RSPAN destination session on another device, you associate the destination port with the RSPAN VLAN. The intermediate switches need only have the RSPAN VLAN carried over source to destination switch links.

Configuring RSPAN
In addition to the guidelines and restrictions that apply to SPAN, these guidelines apply to RSPAN:

  • Networks impose no limit on the number of RSPAN VLANs that the networks carry.
  • Intermediate switches might impose limits on the number of RSPAN VLANs that they can support, based on their capacity.
  • The RSPAN VLANs must be configured in all source, intermediate, and destination network switches.
  • RSPAN VLANs can be used only for RSPAN traffic.
  • Access ports must not be assigned to RSPAN VLANs.
  • Any ports in an RSPAN VLAN, except those selected to carry RSPAN traffic, should not be configured.
  • MAC address learning is disabled on the RSPAN VLAN.
  • RSPAN source ports and destination ports must be on different network devices.
  • RSPAN VLANs cannot be configured as sources in VSPAN sessions.
  • Any VLAN can be configured as an RSPAN VLAN.

Example: Configuring RSPAN
This example shows how to configure RSPAN source session 2:

Switch(config)#monitor session 2 source interface fastethernet1/1 - 3 rx
Switch(config)#monitor session 2 destination remote vlan 901

This example shows how to configure an RSPAN source session with multiple sources:

Switch(config)#monitor session 2 source interface fastethernet 5/15 , 7/3 rx
Switch(config)#monitor session 2 source interface gigabitethernet 1/2 tx
Switch(config)#monitor session 2 source interface port-channel 102
Switch(config)#monitor session 2 source filter vlan 2 – 3
Switch(config)#monitor session 2 destination remote vlan 901

This example shows how to configure an RSPAN destination session:

Switch(config)#monitor session 8 source remote vlan 901
Switch(config)#monitor session 8 destination interface fastethernet 1/2 , 2/3
Lab Activity

Lab Exercise 1: Creating a Switched Port Analyzer (SPAN) Session

In this lab a Switched Port Analyzer (SPAN) session will be created to remotely monitor network traffic.

Lab Activity

Lab Exercise 2: Creating a VSPAN Session

In this lab a VLAN Switchport Analyzer (VSPAN) session is created to remotely monitor network traffic.

Lab Activity

Lab Exercise 3: Creating a RSPAN Session

In this lab a Remote Switchport Analyzer (RSPAN) session will be created on two switches to remotely monitor network traffic.

Configuring the Catalyst Switched Port Analyzer (SPAN) Feature