Content

| 9.1 |  | Monitoring Switched Network Performance with SPAN and VSPAN |
| 9.1.2 |  | Monitoring with SPAN on a port basis |

SPAN can be used to analyze network traffic passing through ports. This occurs by sending a copy of the traffic to a destination port on the switch that has been connected to a network analyzer or protocol analyzer. SPAN can be used to mirror traffic for later analysis. Mirrored traffic is all traffic sent to and/or received from one or more SPAN source ports defined in the SPAN configuration.

SPAN does not affect the switching of network traffic on source ports. A copy of the packets received or sent by the source interfaces is sent to the destination interface. The only traffic sent or received by SPAN destination ports is related to the SPAN process.

A source port is a Layer 2 or Layer 3 port from which the SPAN process copies traffic. Data forwarded from a SPAN source port to a SPAN destination port can include all frames transmitted by the port and/or all frames received by the port.

A SPAN destination port is a Layer 2 or Layer 3 port to which the SPAN process copies traffic. When a port is configured as a SPAN destination port, it can no longer forward any traffic other than SPAN traffic, and becomes dedicated for use by the SPAN process. A SPAN destination port does not forward any traffic except that required for the SPAN session.

Starting with Cisco switch IOS release 12.1(13)E, trunk ports can be configured as SPAN destination ports. This allows SPAN destination ports to transmit traffic encapsulated for multiple VLANs. With earlier switch IOS releases, a trunk port will automatically revert to access mode when configured as a SPAN destination port.