Content

| 9.1 |  | Monitoring Switched Network Performance with SPAN and VSPAN |
| 9.1.6 |  | VSPAN – SPAN using VLANS as monitored source |

SPAN can also be applied on a VLAN basis. A source VLAN is a VLAN monitored for network traffic analysis. VLAN-based SPAN (VSPAN) uses one or more VLANs as the SPAN source. All the ports in the source VLAN(s) become source ports. For VSPAN, only incoming traffic can be monitored (rx traffic). VSPAN cannot be implemented on 2950 switches.

VLAN monitoring is similar to port monitoring. First, any previous SPAN session is cleared from the active configuration using the no monitor session session_number command.

This is followed by defining the VLANs being monitored, using the monitor session session_number source vlan vlan-id [, | -] rx command. Note that other directions are not available for use when setting a VLAN as the SPAN source.

Finally, a destination port is specified for the mirrored traffic by the command monitor session session_number destination interface interface-id module/interface [encapsulation {dot1q | isl}]. Note that ISL cannot be specified on 2950 switches.

The following example shows how to clear any existing configuration on SPAN session 2, configure SPAN session 2 to monitor received traffic on all ports belonging to VLANs 1 through 3, and send it to destination port 7. The configuration is then modified to also monitor received traffic on all ports belonging to VLAN 10.

> Switch(config)#no monitor session 2
> Switch(config)#monitor session 2 source vlan 1 - 3 rx
> Switch(config)#monitor session 2 destination interface gigabitethernet 0/7
> Switch(config)#monitor session 2 source vlan 10 rx
> Switch(config)#end
> Switch#show monitor session 2

To remove one or more source VLANs or destination ports from the SPAN session, the no monitor session session_number source vlan vlan-id global configuration command is used.

To remove the destination interface the no monitor session session_number destination interface interface-id global configuration command is used.

To display the status of the current SPAN configuration, the show monitor privileged EXEC command is used.