In order to collect data traffic on a switched network, special
configuration of a switch port where a network analyzer will be attached is
necessary.
Issue
of Capturing Data in a Switched Network Before switches were so
prevalent in a network, collecting a sample of network traffic was relatively
simple. A network analyzer could be plugged into any free port on a hub to
capture all data frames on the shared segment because all frames were forwarded
out all hub ports. In a switched network, frames are usually isolated to only
the switch ports where the sending and receiving devices are located. This
makes collecting an overall sample of data on a network segment more
challenging.
If a network analyzer is connected to a switch port, by
default the analyzer will only collect data directed to the MAC address of the
analyzer, and any broadcast, multicast or unicast flooding traffic forwarded
out that switch port.
To resolve this issue, Cisco switches allow one or
more ports to be configured as Switch Port Analyzer (SPAN) ports. SPAN sends a
copy of frames generated on one port or an entire VLAN to another switch port
hosting a network analyzer. The concept of SPAN is also referred to as Port
Mirroring or Port Monitoring.
Commands Used to Facilitate Capturing Network Traffic Various
commands are used across Catalyst platforms to inform the switch which port
carries the traffic of interest and to which port the network analyzer will be
attached.
Here are three common commands used to invoke SPAN on various
Catalyst Platforms.
Monitoring Performance with RSPAN Remote SPAN (RSPAN) is a
variation of SPAN. Rather than sending traffic directly to the traffic analyzer
located on the same switch as the port being monitored, RSPAN sends traffic
from a monitored port through an intermediate switch network to a traffic
analyzer on another switch. RSPAN supports source ports, source VLANs, and
destination ports on different switches. RSPAN provides remote monitoring of
ports on multiple switches across the network, as shown in Figure
. The traffic for
each RSPAN session is carried over a user-specified RSPAN VLAN that is
dedicated for that RSPAN session in all participating switches.
RSPAN
consists of an RSPAN source session, an RSPAN VLAN, and an RSPAN destination
session. The RSPAN source session must be configured separately from the
destination sessions given that the two are on different network devices. To
configure an RSPAN source session on one network device, associate a set of
source ports and VLANs with an RSPAN VLAN. To configure an RSPAN destination
session on another device, you associate the destination port with the RSPAN
VLAN. The intermediate switches need only have the RSPAN VLAN carried over
source to destination switch links.
Configuring RSPAN In
addition to the guidelines and restrictions that apply to SPAN, these
guidelines apply to RSPAN:
Networks impose no limit on the number of RSPAN VLANs that the networks
carry.
Intermediate switches might impose limits on the number of RSPAN VLANs that
they can support, based on their capacity.
The RSPAN VLANs must be configured in all source, intermediate, and
destination network switches.
RSPAN VLANs can be used only for RSPAN traffic.
Access ports must not be assigned to RSPAN VLANs.
Any ports in an RSPAN VLAN, except those selected to carry RSPAN traffic,
should not be configured.
MAC address learning is disabled on the RSPAN VLAN.
RSPAN source ports and destination ports must be on different network
devices.
RSPAN VLANs cannot be configured as sources in VSPAN sessions.
Any VLAN can be configured as an RSPAN VLAN.
Example: Configuring RSPAN This example shows how to
configure RSPAN source session 2: