RSPAN and Span ports

[Horacio Gutierrez]

Hello,

I have a few questions regarding RSPAN and Span.  First of what is the difference between RSPAn and Span. Also how does RSPAN actually work can I please get an example.  Can RSPAN analyze different source ports from different switches at the same time. What I want to do is anaylize network traffic from two netwok points, the network path is follow computer plugged to switch port that traffic goes throught ethernet channel to another switch ethernet channel which finishes at the serial link port, any suggestions will RSPAN work from computer port all the way to out serial link port?

Thanks.

[InayathUlla Sharieff]

HI,

There is a method to monitor switch ports

SPAN

RSPAN

ERSPAN

SPAN copies traffic from one or more CPUs, one or more ports, one or more EtherChannels, or one or

more VLANs, and sends the copied traffic to one or more destinations for analysis by a network analyzer

such as a SwitchProbe device or other Remote Monitoring (RMON) probe. Traffic can also be sent to

the processor for packet capture by the Mini Protocol Analyzer

The port can be configured to be monitored and then the traffic that is sent or received on that port can be redirected on the  a port on the same switch (SPAN) or on a different switch (RSPAN) or can be directed to different switches, which provides remote monitoring of multiple switches across your network( ERSPAN) (ERSPAN uses a GRE tunnel to carry traffic between switches.)

A local SPAN session is an association of source ports and source VLANs with one or more destinations.

You configure a local SPAN session on a single switch. Local SPAN does not have separate source and

destination sessions.

RSPAN supports source ports, source VLANs, and destinations on different switches, which provides

remote monitoring of multiple switches across your network (see Figure 2). RSPAN uses a Layer 2

VLAN to carry SPAN traffic between switches.

ERSPAN supports source ports, source VLANs, and destinations on different switches, which provides

remote monitoring of multiple switches across your network (see Figure 3). ERSPAN uses a GRE

tunnel to carry traffic between switches.

For ERSPAN:

Catalyst 6500/6000 Series - Yes Supervisor 720 with PFC3B or PFC3BXL running Cisco IOS Software Release 12.2(18)SXE or later. Supervisor 720 with PFC3A that has hardware version 3.2 or later and running Cisco IOS Software Release 12.2(18)SXE or later

Below are the links were you find the configuration for the same:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/swspan.html

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/span.pdf

HTH

Regards

Inayath

*Plz rate all usefull posts.