SPAN on a 6509...

[bvanderwoude]

I have connected a Network Intrusion Detection device up to our server subnet and have basically swamped the IDS device. I know you can have multiple SPAN statements in the 6509 config, but how many can you have? Also, can you have multiple devices sending information to the same target device (for example, my IDS device)?

[smahbub]

You can have multiple Switched Port Analyzer (SPAN) sessions configured at the same time. But there are certain restrictions while configuring additional SPAN sessions.

For more information on SPAN and Remote SPAN (RSPAN) session limits, refer to these documents:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a00801a5b33.html

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a00801a5b33.html#1033304

For multiple SPAN sessions, add the create keyword at the end when configuring the additional session, as shown:

For configuring the first SPAN session:

6509> (enable) set span 3/1 2/1

For configuring the additional SPAN session:

6509> (enable) set span 3/5 3/10 create