{"id":12616,"date":"2021-07-19T02:58:13","date_gmt":"2021-07-19T02:58:13","guid":{"rendered":"https:\/\/ded9.com\/?p=12616"},"modified":"2025-12-17T09:22:29","modified_gmt":"2025-12-17T09:22:29","slug":"ccna-training-introducing-span","status":"publish","type":"post","link":"https:\/\/ded9.com\/de\/ccna-training-introducing-span\/","title":{"rendered":"CCNA Training: Introducing SPAN (Switched Port Analyzer) for Network Monitoring"},"content":{"rendered":"

SPAN (Remote Switched Port Analyzer) or RSPAN May Be Used Under Different Names in Other Brands, such as 3COM Switches, where it is known as Roving Analysis Port (RAP).<\/span><\/p>\n

SPAN: To briefly introduce the Port Mirroring technique, it sends a copy of network traffic, including an entire LAN, to one or more devices and ports to monitor the network accurately.<\/p>\n

Of course, this method does not require you to worry about your information security because, by activating it, you only receive the Metadata package you need for the monitoring software to retrieve and display the desired information.<\/p>\n

Using the Port Mirroring technique, you can detect security vulnerabilities, network issues, and other problems. You can also mirror all inbound traffic (ingress) and outbound traffic (egress) on a single port, or all interfaces and VLANs of a switch, for monitoring. This is usually used more commonly for incoming network traffic.<\/p>\n

\"Using<\/p>\n

What is SPAN?<\/h2>\n

Property (Switch Port Analyzer (SPAN<\/a>, sometimes called Port Monitoring) and Port Mirroring also call for analyzing network traffic utilizing analyzers. Tools: Network analyzers can provide a Cisco (Cisco Switchprobe) probe, a Remote Monitoring Probe tool, or software. The most straightforward network analysis software is Wireshark or Microsoft Network Monitor, which is called Sniffer network probe tools.<\/p>\n

What is SPAN,<\/strong>\u00a0and\u00a0why do we need it?
\n<\/strong>The SPAN property is generated for the switches, as there is a fundamental difference in performance between the switch and the hub.<\/p>\n

There is no need for SPAN in the hub. If the data packet reaches one of the hub ports, that packet is copied and sent to all ports except the primary port.<\/p>\n

However, after turning it on in the switch, the layer two tables are created from the MAC Address or physical source address (Source MAC Address) of the sent packets. After making<\/strong>\u00a0this table, the\u00a0switch sends the packets directly to the destination port based on this table.<\/strong><\/p>\n

The following figure shows how a hub transfers a packet from source to destination.<\/p>\n

As it turns out, the hub copies or sends the input packet to one port over the other ports, so you can easily eavesdrop on the entire network traffic by setting a sniffer.<\/p>\n

\"As<\/p>\n

 <\/p>\n

We ping PC1 from PC2 and confirm we can easily download the<\/span>\u00a0package.<\/p>\n

\n

\"We<\/a><\/p>\n

Ping<\/span><\/h3>\n<\/div>\n
\n

\"Ping\"<\/p>\n

Wireshark capture<\/span><\/h3>\n<\/div>\n

However, as shown in the figure below, the switch understands computer two’s physical address and keeps it in its MAC table.<\/p>\n

\"However,<\/p>\n

 <\/p>\n

As soon as the data packet is sent from computer 1 to computer 2, the switch uses the MAC table to forward the packet directly to the port connected to computer 2. Therefore, sniffers and monitoring systems cannot access traffic within the network.<\/p>\n

This type of traffic sent to a specific destination is called\u00a0Unicast<\/strong>.<\/span><\/p>\n

\n

\"This<\/p>\n

Ping again<\/h3>\n<\/div>\n
\n

\"ping<\/p>\n

Wireshark ARP request<\/span><\/h3>\n<\/div>\n

But in the example above, the following types of traffic can be received and analyzed by sniffer and monitoring systems:<\/p>\n

    \n
  • Broadcast traffic<\/li>\n
  • Multicast traffic<\/li>\n
  • Unknown monopoly traffic<\/li>\n<\/ul>\n
    \n

    \"Wireshark<\/p>\n

    Send traffic on the switch, usually.<\/p>\n<\/div>\n

    \n

    \"Send<\/p>\n

    Send traffic to the Port Mirroring activation time switch<\/p>\n<\/div>\n

    As mentioned, the traffic switch only sends traffic to the destination you must send it to.<\/p>\n

    \"As<\/p>\n

     <\/p>\n

    An additional feature is needed in the switch to access Unicast packages: the SPAN property. As shown below, with this feature, the traffic between the two ports in the stream can be copied to another port, called SPAN, to be used by Sniffer and the monitoring system.<\/p>\n

    \n

    \"An<\/p>\n

    Switched Port Analyzer (SPAN)<\/span><\/h2>\n<\/div>\n

    0The capabilities of defining a destination in the SPAN technique have greatly improved since the day this technique was introduced.\u00a0When we talk about SPAN, <\/strong>the\u00a0source and destination addresses<\/strong>\u00a0are\u00a0on the same switch<\/strong>\u00a0to which we are currently connected.<\/p>\n

    \n

    \"0The<\/p>\n

    Local SPAN<\/span><\/h2>\n<\/div>\n

    The rules for RSPAN Source are similar to those for SPAN Source, meaning that the source must have at least one physical port or a VLAN on the switch.
    \nThe main difference between RSPAN and SPAN is the destination, which in RSPAN no longer requires a port on the same switch but can be defined on another switch.\u00a0<\/strong><\/p>\n

    In such a case, we create a dedicated VLAN called\u00a0RSPAN\u00a0VLAN<\/strong> to implement RSPAN; this VLAN includes the ports defined in the source switch and the destination switch. As you can see in the image below, the traffic sent from the RSPAN VLAN as a trunk will be visible at the destination.<\/p>\n

    \n

    \"In<\/p>\n

    Remote SPAN – RSPAN<\/span><\/h2>\n<\/div>\n

    Finally,\u00a0if our traffic is to pass through several different routers and network infrastructures, we use another technique called Encapsulated Remote SPAN or ERSPAN.<\/strong><\/p>\n

    The source defined in SPAN consists of at least one physical port or VLAN on the same switch that we want to monitor. The destination port must also be on the same switch. Once configured, SPAN Source traffic is sent to the SPAN Destination Port.<\/p>\n

    \n

    \"The<\/p>\n

    Encapsulated Remote SPAN or ERSPAN<\/p>\n<\/div>\n

    SPAN startup requirements<\/span><\/h2>\n

    SPAN, RSPAN, and ERSPAN all have a series of technical conditions and requirements to be able to monitor and send traffic properly:<\/p>\n

      \n
    1. SPAN Source can be a physical port or a VLAN; the two can not be combined.<\/li>\n
    2. A-SPAN Source Port cannot be a Destination Port simultaneously, and vice versa.<\/li>\n
    3. Whether SPAN, RSPAN, or ERSPAN, each session can mirror traffic to only one destination, and sharing on destination ports is meaningless.<\/li>\n
    4. When Trunk ports are defined as Sources in SPAN, all traffic in VLANs is monitored by default. If you want to monitor only specific traffic, you must filter your desired VLAN.<\/li>\n<\/ol>\n

      Catalyst Switches that support SPAN, RSPAN, and ERSPAN:<\/span><\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
      SPAN Support<\/strong><\/td>\nRSPAN Support<\/strong><\/td>\nERSPAN Support<\/strong><\/td>\nCatalyst Switches<\/strong><\/td>\n<\/tr>\n
      Yes<\/td>\nNo<\/td>\nNo<\/td>\nCatalyst Express 500\/520 Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nSupervisor 2T with PFC4, Supervisor 720 with PFC3B or PFC3BXL running Cisco IOS Software Release 12.2 (18) SXE or later. Supervisor 720 with PFC3A that has hardware version 3.2 or later and running Cisco IOS Software Release 12.2 (18) SXE or later<\/td>\nCatalyst 6500\/6000 Series<\/td>\n<\/tr>\n
      Yes<\/td>\nNo<\/td>\nNo<\/td>\nCatalyst 5500\/5000 Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 4900 Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 4500\/4000 Series (includes 4912G)<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 3750 Metro Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 3750 \/ 3750E \/ 3750X Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 3560 \/ 3560E \/ 3650X Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 3550 Series<\/td>\n<\/tr>\n
      Yes<\/td>\nNo<\/td>\nNo<\/td>\nCatalyst 3500 XL Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 2970 Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 2960 Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 2955 Series<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 2950 Series<\/td>\n<\/tr>\n
      Yes<\/td>\nNo<\/td>\nNo<\/td>\nCatalyst 2940 Series<\/td>\n<\/tr>\n
      No<\/td>\nNo<\/td>\nNo<\/td>\nCatalyst 2948G-L3<\/td>\n<\/tr>\n
      Yes<\/td>\nYes<\/td>\nNo<\/td>\nCatalyst 2948G-L2, 2948G-GE-TX, 2980G-A<\/td>\n<\/tr>\n
      Yes<\/td>\nNo<\/td>\nNo<\/td>\nCatalyst 2900XL Series<\/td>\n<\/tr>\n
      Yes<\/td>\nNo<\/td>\nNo<\/td>\nCatalyst 1900 Series<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Implementing SPAN at Cisco<\/span><\/h2>\n

      Consider the following network: PC2, PC3, and PC4. It is a good idea to send a copy to PC5 for any traffic they send and receive. S, we have to introduce the GIG 0\/3 interface as SPAN.<\/p>\n

      \"Consider<\/p>\n

       <\/p>\n

      Specify the following command to specify sources:<\/span><\/h2>\n

      Switch (config) #\u00a0monitor session 1 source interface fastEthernet0 \/ 0 – 2 bath<\/strong><\/p>\n

      Note: To send traffic send and receive both, and for traffic send tx and traffic receive rx, if we do not enter anything, both will be activated automatically.<\/p><\/blockquote>\n

      And now, to send a copy of the traffic to PC5, we enter the following command:<\/p>\n

      Switch (config) #\u00a0monitor session 1 destination interface gigabitethernet0 \/ 3<\/strong><\/p>\n

      FAQ<\/h2>\n
      \n
      \n
      \n

      What is SPAN in Cisco networking?<\/h3>\n
      \n\n

      SPAN (Switched Port Analyzer) copies traffic from one or more source ports or VLANs to a destination port for monitoring and analysis.<\/p>\n\n<\/div>\n<\/div>\n

      \n

      Why is SPAN used in network monitoring?<\/h3>\n
      \n\n

      SPAN allows administrators to capture and analyze network traffic that would otherwise be switched directly to its destination, enabling troubleshooting and security analysis.<\/p>\n\n<\/div>\n<\/div>\n

      \n

      What is the difference between SPAN and RSPAN?<\/h3>\n
      \n\n

      SPAN mirrors traffic on the same switch, while RSPAN can send mirrored traffic across switches using a dedicated VLAN.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"

      SPAN (Remote Switched Port Analyzer) or RSPAN May Be Used Under Different Names in Other Brands, such as 3COM Switches, where it is known as Roving Analysis Port (RAP). SPAN: To briefly introduce the Port Mirroring technique, it sends a copy of network traffic, including an entire LAN, to one or more devices and ports […]<\/p>\n","protected":false},"author":6,"featured_media":12617,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[96],"tags":[4398],"class_list":["post-12616","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-network","tag-mac-address"],"acf":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/posts\/12616","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/comments?post=12616"}],"version-history":[{"count":7,"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/posts\/12616\/revisions"}],"predecessor-version":[{"id":266226,"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/posts\/12616\/revisions\/266226"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/media\/12617"}],"wp:attachment":[{"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/media?parent=12616"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/categories?post=12616"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ded9.com\/de\/wp-json\/wp\/v2\/tags?post=12616"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}