cisco全系列交换机镜像配置.rarcisco全系列交换机镜像配置.rar

Table of Contents

Configuring the Catalyst Switched Port Analyzer (SPAN)............................................................................1

Introduction.............................................................................................................................................1

Before You Begin...................................................................................................................................2

Conventions......................................................................................................................................2

Brief Description of SPAN...............................................................................................................2

SPAN Terminology..........................................................................................................................3

Components Used.............................................................................................................................4

SPAN on the Catalyst 2900XL/3500XL Switches.................................................................................4

Remote SPAN................................................................................................................................16

Feature Summary and Limitations.................................................................................................19

SPAN on the Catalyst 2950/Catalyst 3550 Series Switches.................................................................20

SPAN on the Catalyst 4000 and Catalyst 6000 Series Switches Running Integrated Cisco IOS.........21

Feature Summary and Limitations.................................................................................................21

Performance Impact of SPAN on the Different Catalyst Platforms.....................................................22

Catalyst 2900XL/3500XL Family..................................................................................................22

Catalyst 4000 Family......................................................................................................................23

Catalyst 5000/6000 Family............................................................................................................24

Frequently Asked Questions and Common Problems..........................................................................25

Related Information..............................................................................................................................28

Cisco − Configuring the Catalyst Switched Port Analyzer (SPAN)

i

Configuring the Catalyst Switched Port Analyzer

(SPAN)

Introduction

Before You Begin

Conventions

Brief Description of SPAN

SPAN Terminology

SPAN on the Catalyst 4000, 5000, and 6000 Series Switches Running CatOS

Local SPAN

Remote SPAN

Feature Summary and Limitations

SPAN on the Catalyst 2950/Catalyst 3550 Series Switches

SPAN on the Catalyst 4000 and Catalyst 6000 Series Switches Running Integrated Cisco

IOS

Feature Summary and Limitations

Performance Impact of SPAN on the Different Catalyst Platforms

Catalyst 2900XL/3500XL Family

Can I Configure SPAN on an EtherChannel Port?

Can I Have Several SPAN Sessions Running at the Same Time?

Why Am I Not Able to Capture Corrupted Packets with SPAN?

Related Information

Introduction

The Switched Port Analyzer (SPAN) feature, sometimes called port mirroring or port monitoring, selects

network traffic for analysis by a network analyzer such as a SwitchProbe device or other Remote Monitoring

(RMON) probe. Previously, SPAN was a relatively basic feature on the Catalyst family of switches, but the

latest releases of the CatOS introduced great enhancements and many new possibilities that are now available

to the user. This document is not intended to be an alternate configuration guide for the SPAN feature, but

Cisco − Configuring the Catalyst Switched Port Analyzer (SPAN)

Before You Begin

Conventions

For more information on document conventions, see the Cisco Technical Tips Conventions.

Brief Description of SPAN

What is SPAN and why is it needed? The SPAN feature was introduced on switches because of a fundamental

difference they have with hubs. When a hub receives a packet on one port, it will send out a copy of that

packet on all ports except on the one where it was received. After a switch boots up, it will start to build up a

Layer 2 forwarding table based upon the source MAC address of the different packets received. Once this

forwarding table has been built, the switch forwards traffic destined for a MAC address directly to the

corresponding port.

the switch does not have the destination MAC in its CAM table. It will not know where to send the traffic and

it will flood the packets to all the ports in the destination VLAN.

Cisco − Configuring the Catalyst Switched Port Analyzer (SPAN)

An extra feature is needed that will artificially copy unicast packets sent by host A to the sniffer port:

In this above diagram, the sniffer is attached to a port that is configured to receive a copy of every single

packet that is sent by host A. This port is called a SPAN port. The sections below describe how this feature

can be tuned very precisely to do more than just monitoring a port.

SPAN Terminology

Ingress traffic: traffic entering the switch•

Egress traffic: traffic leaving the switch•

Source (SPAN) Port: port that is monitored using the SPAN feature.•

Remote SPAN or RSPAN: some source ports are not located on the same switch as the destination

port. This is an advanced feature that requires a special VLAN to carry the traffic being monitored by

SPAN between switches. RSPAN is not supported on all switches so please check the respective

release notes or configuration guide to see if it can be used on the switch you are deploying.

•

Cisco − Configuring the Catalyst Switched Port Analyzer (SPAN)

PSPAN: stands for port−based SPAN. The user specifies one or several source ports on the switch

and one destination port.

•

VSPAN: stands for VLAN−based SPAN. On a given switch, the user can choose to monitor all the

ports belonging to a particular VLAN in a single command.

•

ESPAN means enhanced SPAN version. This term has been used several times during the evolution

of the SPAN to name additional features and, therefore, is not very clear. Its use is avoided in this

document.

•

2900XL/3500XL family, Cisco IOS® Software Release 12.0(5)XU is used. Though this document will be

updated to reflect changes to SPAN, see the documentation release notes for the latest developments on the

SPAN feature.

The information presented in this document was created from devices in a specific lab environment. All of the

devices used in this document started with a cleared (default) configuration. If you are working in a live

network, ensure that you understand the potential impact of any command before using it.

SPAN on the Catalyst 2900XL/3500XL Switches

Features Available and Restrictions

The port monitoring feature is not very extended on the Catalyst 2900XL/3500XL and is therefore relatively

easy to understand.

If you do not specify any interface in the port monitor command, all other ports belonging to the same

VLAN as the interface will be monitored.

•

Here are some restrictions that are taken from the Catalyst 2900XL/3500XL Command Reference:

ATM ports are the only ports that cannot be monitor ports. However, you can monitor ATM ports. The

following restrictions apply for ports that have port−monitoring capability:

A monitor port cannot be in a Fast EtherChannel or Gigabit EtherChannel port group.•

A monitor port cannot be enabled for port security.•

A monitor port cannot be a multi−VLAN port.•

A monitor port must be a member of the same VLAN as the port monitored. VLAN membership

changes are disallowed on monitor ports and ports being monitored.

•

Cisco − Configuring the Catalyst Switched Port Analyzer (SPAN)