How Does SPAN Work?

[Orionesque]

How does SPAN work on Catalyst access switches? Lets say we have a packet come in on one interface (e.g. 1) leave on another (e.g. 2). If I have a SPAN session on both of these ports and lets say they are on the same VLAN and part of the same SPAN session. Does that mean the packet gets registered twice? Once incoming on port 1 and once when it leave on port 2?

[Blue_Bird]

Hello @Orionesque 

Yes, the packet will be captured twice.

When you configure both interfaces in the same SPAN session:

First copy (Ingress/RX): The switch ASIC mirrors the packet as soon as it arrives on Port 1.

Second copy (Egress/TX): After the switch processes and forwards the frame to Port 2, the ASIC mirrors it again as it exits Port 2.

Reference: https://ciscolearningservices.my.site.com/cln/s/article/span-rspan-erspan#:~:text=When%20VLAN%20is%20configured%20as%20SPAN%20source,the%20egress%20traffic%20on%20the%20egress%20port.

Best regards
******* If This Helps, Please Rate ******

[DFWTechGuy]

Yes. If you're mirroring both the ingress traffic on port 1 and the egress traffic on port 2 in the same SPAN session, you'll typically see the same packet twice: once when it enters port 1 and again when it leaves port 2. If you only want one copy of the packet, configure the SPAN session to capture only ingress or only egress traffic, depending on what you're trying to analyze.