- SPAN, or Switched Port Analyzer, is another way
that we can monitor our network traffic.
This is also referred to as port mirroring
and that's exactly what happens with SPAN.
A SPAN-enabled switchboard will send a copy
of all of the network packets seen on the port
or on the VLAN over to a separate port,
which is typically connected to some type
of traffic analyzer technology.
These analyzers offer many of the same advantages
as the centralized technologies we've examined already
with syslog, SNMP and NetFlow.
They allow for aggregated and centralized data collection
and correlation for much easier interpretation.
Cisco switches have three main variations for using SPAN.
There's traditional SPAN or local SPAN
which is the most basic iteration.
With local SPAN, traffic is captured locally on a switch,
and mirrored to another local port on the device,
where some type of SPAN analyzer would be connected.
There's also remote SPAN, or RSPAN.
With RSPAN, you can monitor traffic from remote locations
that are distributed over multiple switches
throughout the network.
You'd most likely have a central switch
physically connected to a SPAN traffic analyzer
and that would be used as your RSPAN destination
on all of the remote switches.
The traffic from remote switches would be mirrored
onto its own VLAN that would be dedicated to RSPAN traffic.
And the VLAN would be connected via trunk links
to the other switches.
And that would be eventually carried to the central switch
and directed to the SPAN traffic analyzer.
And there's encapsulated remote SPAN, or ERSPAN.
This is similar to RSPAN, but rather than
sending the traffic through Layer Two switching
as RSPAN does, this uses Layer Three routing
to send traffic to a central location
using generic routing encapsulation, or GRE.
This particular version is CISCO-proprietary.
The interfaces from which we can monitor SPAN traffic
are referred to as SPAN source ports, or monitor ports.
When configuring SPAN monitor ports, we can choose
the direction for monitoring to take place as well.
In other words, do we want to monitor traffic
in the received direction or in the send direction.
These two options are seen in iOS as receive source,
indicated by an Rx, and transmit source, indicated by a Tx.
You can choose to monitor bidirectionally as well,
using both send and receive data.
SPAN source ports can be any type of port
that can be EtherChannel, FastEthernet,
Gigabit Ethernet and so on.
You can also create multiple SPAN sessions
where these ports have overlap between the sessions
so they can be monitored in multiple sessions.
Having said that, most switches do support at least
two SPAN sessions, but more modern devices can support
many more than that.
So that's a device-specific limitation
that you'll want to explore when you're configuring
your own equipment.
Monitored source ports can be in the same
or in separate VLANs, so they don't have to reside
in the same place.
One notable caveat is that the SPAN destination port,
which is the port where traffic is being mirrored to
for analysis, that port cannot be included as a source port
at the same time.
So source and destination for a SPAN session
must use two different ports.
Another warning to mention in regard to SPAN,
is that it's possible to completely saturate
your destination port with information.
Especially in cases where maybe you're monitoring
source ports that might have 10 gig interfaces
and maybe your destination port is only a one gig interface.
So just be aware of this when you're configuring SPAN
and when you're choosing
a central location for your SPAN collector.
So that's a look at the basic use cases and components
used in a SPAN configuration.
In the subsequent videos for this module,
we'll examine how to configure a local SPAN,
RSPAN and ERSPAN using Cisco Catalyst switches.