SPAN questions...

mohsin.khan · ‎10-22-2009

Hi,

1. What is the difference between source sessions (span) and Destination sessions (Span)? Which one is recommended in which particular case?

2. Using RSPAN, what are the concerns that i should be on lookout for? I am going to span the traffic of 4 live web servers to a single port. All 4 of the Servers are directly connected to Cat 6509. Considering the traffic of approx 10 mb on each server, with 6509 equiped with dual sup, csm, 10g card and other RJ45 cards, what would be a better design (if i don't want my switch to get spikes on cpu) out of (1. i connect the Analyzer on an interface of the same switch and still run the remote span? OR 2. Connect a small L2 switch with Cat 6500, connect the analyzer with that, extend the RSPAN vlan to that l2 switch and do the mirroring? OR if there is any other more recommended design for this?

Peter Paluch · ‎10-23-2009

Hello,

I can answer only to your first question. The second question should be answered by more experienced colleagues here.

Regarding the source and destination sessions, they are the building blocks of a RSPAN session. The idea is that in a RSPAN, the traffic from monitored ports is sent to a special VLAN designated only for this purpose. The switch that is capturing traffic from monitored ports and replicates it into this RSPAN VLAN runs a source RSPAN session. Some other switch may then take the traffic out of this VLAN and replicate it onto selected ports for monitoring and analysis purposes. We say that this second switch runs a destination RSPAN session.

So the difference is that the source RSPAN session captures the traffic from selected ports and replicates it into a designated RSPAN VLAN. The destination RSPAN session takes the traffic out of this RSPAN VLAN and sends it out on selected ports. You need both sessions, source and destination, to have a functional RSPAN monitoring in a network.

I suggest reading the following document. While it is a configuration guide for 3560 series switches, the SPAN/RSPAN description is very illustrative.

http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst3560/software/release/12.2_52_se/configuration/guide/swspan.html

Best regards,

Peter

mohsin.khan · ‎10-23-2009

Thanks peter. Anyone helping for the 2nd question?

James Hawkins · ‎10-25-2009

Hi

I am not sure whether it is the case with 6500 switches but with 3750's the RSPAN source caanot be ports or VLANs on the same switch as the destination port to which you connect your monitor.

If the web servers and monitor are on the same switch I would just set up local SPAN with the four web server ports as sources and the monitor port as a destination. If the switch is not highly utilised before this configuration is implemented then it should be abale to cope with it without any problems.