Configuring SPAN

SPAN mirrors traffic from one or more source interfaces on any VLAN or from one or more VLANs to a destination interface for analysis.

Examples of setting up source:

//monitor bidirectional traffic from source interface fast ethernet 4/10
monitor session 1 source interface fastethernet 4/10

//differing directions within a SPAN session (parameters rx and tx)
monitor session 1 source interface fa2/3 rx //Receive
monitor session 1 source interface fa2/2 tx //Transmit

//using ranges
monitor session 1 source interface fastethernet 4/1-10

//listing several VLANs
monitor session 1 source vlan 4, 5-7

Setting up destination:

monitor session 1 destination interface fastethernet 4/15

//specifying the encapsulation type used by the destination port
monitor session 1 destination interface fastethernet 5/48 encapsulation dot1q

Encapsulation options:

isl - Use ISL

dot1q - Use 802.1Q

"replicate" is not supported

without encapsulation mode - the port default is untagged

Verifying the configuration:

show monitor

//only session 1

show monitor session 1

Removing configuration:

no monitor session 1

For more commands and options see the reference:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/20ew/configuration/guide/config/span.html#wp1043935