Configuring SPAN and RSPAN

• Prerequisites for SPAN and RSPAN, on page 1

• Restrictions for SPAN and RSPAN, on page 1
• Information About SPAN and RSPAN, on page 3
• Configuring SPAN and RSPAN, on page 12
• How to Configure SPAN and RSPAN, on page 13
• Monitoring SPAN and RSPAN Operations, on page 35
• Configuration Examples for SPAN and RSPAN, on page 35
• Feature History for SPAN and RSPAN, on page 37

Prerequisites for SPAN and RSPAN

SPAN
You can limit SPAN traffic to specific VLANs by using the filter vlan keyword. If a trunk port is being
monitored, only traffic on the VLANs specified with this keyword is monitored. By default, all VLANs are
monitored on a trunk port.

RSPAN
We recommend that you configure an RSPAN VLAN before you configure an RSPAN source or a destination
session.

Restrictions for SPAN and RSPAN

SPAN
The restrictions for SPAN are as follows:
• On each device, you can configure 66 sessions. A maximum of 8 source sessions can be configured and
the remaining sessions can be configured as RSPAN destinations sessions. A source session is either a
local SPAN session or an RSPAN source session.
• For SPAN sources, you can monitor traffic for a single port or VLAN or a series or range of ports or
VLANs for each session. You cannot mix source ports and source VLANs within a single SPAN session.

Configuring SPAN and RSPAN

1
 Configuring SPAN and RSPAN
Restrictions for SPAN and RSPAN

• The destination port cannot be a source port; a source port cannot be a destination port.
• You cannot have two SPAN sessions using the same destination port.
• When you configure a device port as a SPAN destination port, it is no longer a normal device port; only
monitored traffic passes through the SPAN destination port.
• Entering SPAN configuration commands does not remove previously configured SPAN parameters. You
must enter the no monitor session {session_number | all | local | remote} global configuration command
to delete configured SPAN parameters.
• For local SPAN, outgoing packets through the SPAN destination port carry the original encapsulation
headers—untagged, ISL, or IEEE 802.1Q—if the encapsulation replicate keywords are specified. If
the keywords are not specified, the packets are sent in native form.
• You can configure a disabled port to be a source or destination port, but the SPAN function does not
start until the destination port and at least one source port or source VLAN are enabled.
• You cannot mix source VLANs and filter VLANs within a single SPAN session.

Traffic monitoring in a SPAN session has the following restrictions:

• Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same session.
• Wireshark does not capture egress packets when egress span is active.
• You can run both a local SPAN and an RSPAN source session in the same device or device stack. The
device or device stack supports a total of 66 source and RSPAN destination sessions.
• You can configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of
SPAN source ports and VLANs. Both switched and routed ports can be configured as SPAN sources
and destinations.
• You can have multiple destination ports in a SPAN session, but no more than 64 destination ports per
device stack .
• SPAN sessions do not interfere with the normal operation of the device. However, an oversubscribed
SPAN destination, for example, a 10-Mb/s port monitoring a 100-Mb/s port, can result in dropped or
lost packets.
• When SPAN or RSPAN is enabled, each packet being monitored is sent twice, once as normal traffic
and once as a monitored packet. Monitoring a large number of ports or VLANs could potentially generate
large amounts of network traffic.
• You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active
unless you enable the destination port and at least one source port or VLAN for that session.
• The device does not support a combination of local SPAN and RSPAN in a single session.
• An RSPAN source session cannot have a local destination port.
• An RSPAN destination session cannot have a local source port.
• An RSPAN destination session and an RSPAN source session that are using the same RSPAN
VLAN cannot run on the same device or device stack.

Configuring SPAN and RSPAN

2
 Configuring SPAN and RSPAN
Information About SPAN and RSPAN

RSPAN
The restrictions for RSPAN are as follows:
• RSPAN does not support BPDU packet monitoring or other Layer 2 device protocols.
• The RSPAN VLAN is configured only on trunk ports and not on access ports. To avoid unwanted traffic
in RSPAN VLANs, make sure that the VLAN remote-span feature is supported in all the participating
devices.
• RSPAN VLANs are included as sources for port-based RSPAN sessions when source trunk ports have
active RSPAN VLANs. RSPAN VLANs can also be sources in SPAN sessions. However, since the
device does not monitor spanned traffic, it does not support egress spanning of packets on any RSPAN
VLAN identified as the destination of an RSPAN source session on the device.
• If you enable VTP and VTP pruning, RSPAN traffic is pruned in the trunks to prevent the unwanted
flooding of RSPAN traffic across the network for VLAN IDs that are lower than 1005.
• It is recommended not to configure RSPAN VLAN as Native VLAN.
• RSPAN sessions do not capture DHCP-inject packets. DHCP-inject packets refer to DHCP packets
(DISCOVER, OFFER, REQUEST, and ACK packets) which are modified by the CPU and inserted back
into the network.

Information About SPAN and RSPAN

The following sections provide information about SPAN and RSPAN.

SPAN and RSPAN

You can analyze network traffic passing through ports or VLANs by using SPAN or RSPAN to send a copy
of the traffic to another port on the device or on another device that has been connected to a network analyzer
or other monitoring or security device. SPAN copies (or mirrors) traffic received or sent (or both) on source
ports or source VLANs to a destination port for analysis. SPAN does not affect the switching of network
traffic on the source ports or VLANs. You must dedicate the destination port for SPAN use. Except for traffic
that is required for the SPAN or RSPAN session, destination ports do not receive or forward traffic.
Only traffic that enters or leaves source ports or traffic that enters or leaves source VLANs can be monitored
by using SPAN; traffic routed to a source VLAN cannot be monitored. For example, if incoming traffic is
being monitored, traffic that gets routed from another VLAN to the source VLAN cannot be monitored;
however, traffic that is received on the source VLAN and routed to another VLAN can be monitored.
You can use the SPAN or RSPAN destination port to inject traffic from a network security device. For example,
if you connect a Cisco Intrusion Detection System (IDS) sensor appliance to a destination port, the IDS device
can send TCP reset packets to close down the TCP session of a suspected attacker.

Local SPAN
Local SPAN supports a SPAN session entirely within one device; all source ports or source VLANs and
destination ports are in the same device or device stack. Local SPAN copies traffic from one or more source
ports in any VLAN or from one or more VLANs to a destination port for analysis.

Configuring SPAN and RSPAN

3
 Configuring SPAN and RSPAN
Remote SPAN

Local SPAN supports a SPAN session entirely within one switch; all source ports and destination ports are
in the same switch. Local SPAN copies traffic from one or more source ports to a destination port for analysis.
Figure 1: Example of Local SPAN Configuration on a Single Device

All traffic on port 5 (the source port) is mirrored to port 10 (the destination port). A network analyzer on port
10 receives all network traffic from port 5 without being physically attached to port 5.

Figure 2: Example of Local SPAN Configuration on a Device Stack

This is an example of a local SPAN in a device stack, where the source and destination ports reside on different
stack members.

Remote SPAN
RSPAN supports source ports, source VLANs, and destination ports on different devices (or different device
stacks), enabling remote monitoring of multiple devices across your network.

Configuring SPAN and RSPAN

4
 Configuring SPAN and RSPAN
SPAN and RSPAN Concepts and Terminology

Figure 3: Example of RSPAN Configuration

The figure below shows source ports on Device A and Device B. The traffic for each RSPAN session is carried
over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating devices.
The RSPAN traffic from the source ports or VLANs is copied into the RSPAN VLAN and forwarded over
trunk ports carrying the RSPAN VLAN to a destination session monitoring the RSPAN VLAN. Each RSPAN
source device must have either ports or VLANs as RSPAN sources. The destination is always a physical port,

as shown on Device C in the figure.

SPAN and RSPAN Concepts and Terminology

SPAN Sessions
SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs,
and send the monitored traffic to one or more destination ports.
A local SPAN session is an association of a destination port with source ports or source VLANs, all on a
single network device. Local SPAN does not have separate source and destination sessions. Local SPAN
sessions gather a set of ingress and egress packets specified by the user and form them into a stream of SPAN
data, which is directed to the destination port.
RSPAN consists of at least one RSPAN source session, an RSPAN VLAN, and at least one RSPAN destination
session. You separately configure RSPAN source sessions and RSPAN destination sessions on different
network devices. To configure an RSPAN source session on a device, you associate a set of source ports or
source VLANs with an RSPAN VLAN. The output of this session is the stream of SPAN packets that are
sent to the RSPAN VLAN. To configure an RSPAN destination session on another device, you associate the

Configuring SPAN and RSPAN

5
 Configuring SPAN and RSPAN
Monitored Traffic

destination port with the RSPAN VLAN. The destination session collects all RSPAN VLAN traffic and sends
it out the RSPAN destination port.
An RSPAN source session is very similar to a local SPAN session, except for where the packet stream is
directed. In an RSPAN source session, SPAN packets are relabeled with the RSPAN VLAN ID and directed
over normal trunk ports to the destination device.
An RSPAN destination session takes all packets received on the RSPAN VLAN, strips off the VLAN tagging,
and presents them on the destination port. The session presents a copy of all RSPAN VLAN packets (except
Layer 2 control packets) to the user for analysis.
Traffic monitoring in a SPAN session has these restrictions:
• Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same session.
• You can run both a local SPAN and an RSPAN source session in the same device or device stack. The
device or device stack supports a total of 66 source and RSPAN destination sessions.
• You can configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of
SPAN source ports and VLANs. Both switched and routed ports can be configured as SPAN sources
and destinations.
• You can have multiple destination ports in a SPAN session, but no more than 64 destination ports per
device stack.
• SPAN sessions do not interfere with the normal operation of the device. However, an oversubscribed
SPAN destination, for example, a 10-Mb/s port monitoring a 100-Mb/s port, can result in dropped or
lost packets.
• When SPAN or RSPAN is enabled, each packet being monitored is sent twice, once as normal traffic
and once as a monitored packet. Therefore monitoring a large number of ports or VLANs could potentially
generate large amounts of network traffic.
• You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active
unless you enable the destination port and at least one source port or VLAN for that session.
• The device does not support a combination of local SPAN and RSPAN in a single session.
• An RSPAN source session cannot have a local destination port.
• An RSPAN destination session cannot have a local source port.
• An RSPAN destination session and an RSPAN source session that are using the same RSPAN
VLAN cannot run on the same device or device stack.

Monitored Traffic
SPAN sessions can monitor these traffic types:
• Receive (Rx) SPAN—Receive (or ingress) SPAN monitors as much as possible all of the packets received
by the source interface or VLAN before any modification or processing is performed by the device. A
copy of each packet received by the source is sent to the destination port for that SPAN session.
Packets that are modified because of routing or Quality of Service (QoS)—for example, modified
Differentiated Services Code Point (DSCP)—are copied before modification.
Features that can cause a packet to be dropped during receive processing have no effect on ingress SPAN;
the destination port receives a copy of the packet even if the actual incoming packet is dropped. These

Configuring SPAN and RSPAN

6
 Configuring SPAN and RSPAN
Source Ports

features include IP standard and extended input Access Control Lists (ACLs), ingress QoS policing,
VLAN ACLs, and egress QoS policing.
• Transmit (Tx) SPAN—Transmit (or egress) SPAN monitors as much as possible all of the packets sent
by the source interface after all modification and processing is performed by the device. A copy of each
packet sent by the source is sent to the destination port for that SPAN session. The copy is provided after
the packet is modified.
Packets that are modified because of routing (for example, with modified time-to-live (TTL), MAC
address, or QoS values) are duplicated (with the modifications) at the destination port.
Features that can cause a packet to be dropped during transmit processing also affect the duplicated copy
for SPAN. These features include IP standard and extended output ACLs and egress QoS policing.
• Both—In a SPAN session, you can also monitor a port or VLAN for both received and sent packets.
This is the default.

The default configuration for local SPAN session ports is to send all packets untagged. However, when you
enter the encapsulation replicate keywords while configuring a destination port, these changes occur:
• Packets are sent on the destination port with the same encapsulation (untagged or IEEE 802.1Q) that
they had on the source port.
• Packets of all types, including BPDU and Layer 2 protocol packets, are monitored.

Therefore, a local SPAN session with encapsulation replicate enabled can have a mixture of untagged and
IEEE 802.1Q tagged packets appear on the destination port.
Device congestion can cause packets to be dropped at ingress source ports, egress source ports, or SPAN
destination ports. In general, these characteristics are independent of one another. For example:
• A packet might be forwarded normally but dropped from monitoring due to an oversubscribed SPAN
destination port.
• An ingress packet might be dropped from normal forwarding, but still appear on the SPAN destination
port.
• An egress packet dropped because of device congestion is also dropped from egress SPAN.

In some SPAN configurations, multiple copies of the same source packet are sent to the SPAN destination
port. For example, a bidirectional (both Rx and Tx) SPAN session is configured for the Rx monitor on port
A and Tx monitor on port B. If a packet enters the device through port A and is switched to port B, both
incoming and outgoing packets are sent to the destination port. Both packets are the same unless a Layer 3
rewrite occurs, in which case the packets are different because of the packet modification.

Source Ports
A source port (also called a monitored port) is a switched or routed port that you monitor for network traffic
analysis.
In a local SPAN session or RSPAN source session, you can monitor source ports or VLANs for traffic in one
or both directions.
The device supports any number of source ports (up to the maximum number of available ports on the device)
and any number of source VLANs (up to the maximum number of VLANs supported).
You cannot mix ports and VLANs in a single session.

Configuring SPAN and RSPAN

7
 Configuring SPAN and RSPAN
Source VLANs

A source port has these characteristics:

• It can be monitored in multiple SPAN sessions.
• Each source port can be configured with a direction (ingress, egress, or both) to monitor.
• It can be any port type (for example, EtherChannel, Gigabit Ethernet, and so forth).
• For EtherChannel sources, you can monitor traffic for the entire EtherChannel or individually on a
physical port as it participates in the port channel.
• It can be an access port, trunk port, routed port, or voice VLAN port.
• It cannot be a destination port.
• Source ports can be in the same or different VLANs.
• You can monitor multiple source ports in a single session.

Source VLANs
VLAN-based SPAN (VSPAN) is the monitoring of the network traffic in one or more VLANs. The SPAN
or RSPAN source interface in VSPAN is a VLAN ID, and traffic is monitored on all the ports for that VLAN.
VSPAN has these characteristics:
• All active ports in the source VLAN are included as source ports and can be monitored in either or both
directions.
• On a given port, only traffic on the monitored VLAN is sent to the destination port.
• If a destination port belongs to a source VLAN, it is excluded from the source list and is not monitored.
• If ports are added to or removed from the source VLANs, the traffic on the source VLAN received by
those ports is added to or removed from the sources being monitored.
• You cannot use filter VLANs in the same session with VLAN sources.
• You can monitor only Ethernet VLANs.

VLAN Filtering
When you monitor a trunk port as a source port, by default, all VLANs active on the trunk are monitored.
You can limit SPAN traffic monitoring on trunk source ports to specific VLANs by using VLAN filtering.
• VLAN filtering applies only to trunk ports or to voice VLAN ports.
• VLAN filtering applies only to port-based sessions and is not allowed in sessions with VLAN sources.
• When a VLAN filter list is specified, only those VLANs in the list are monitored on trunk ports or on
voice VLAN access ports.
• SPAN traffic coming from other port types is not affected by VLAN filtering; that is, all VLANs are
allowed on other ports.
• VLAN filtering affects only traffic forwarded to the destination SPAN port and does not affect the
switching of normal traffic.

Configuring SPAN and RSPAN

8
 Configuring SPAN and RSPAN
Destination Port

Destination Port
Each local SPAN session or RSPAN destination session must have a destination port (also called a monitoring
port) that receives a copy of traffic from the source ports or VLANs and sends the SPAN packets to the user,
usually a network analyzer.
A destination port has these characteristics:
• For a local SPAN session, the destination port must reside on the same device or device stack as the
source port. For an RSPAN session, it is located on the device containing the RSPAN destination session.
There is no destination port on a device or device stack running only an RSPAN source session.
• When a port is configured as a SPAN destination port, the configuration overwrites the original port
configuration. When the SPAN destination configuration is removed, the port reverts to its previous
configuration. If a configuration change is made to the port while it is acting as a SPAN destination port,
the change does not take effect until the SPAN destination configuration had been removed.
• If the port was in an EtherChannel group, it is removed from the group while it is a destination port. If
it was a routed port, it is no longer a routed port.
• It can be any Ethernet physical port.
• It cannot be a secure port.
• It cannot be a source port.
• It can participate in only one SPAN session at a time (a destination port in one SPAN session cannot be
a destination port for a second SPAN session).
• When it is active, incoming traffic is disabled. The port does not transmit any traffic except that required
for the SPAN session. Incoming traffic is never learned or forwarded on a destination port.
• If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic
at Layer 2.
• It does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP).
• A destination port that belongs to a source VLAN of any SPAN session is excluded from the source list
and is not monitored.
• The maximum number of destination ports in a device or device stack is 64.

Local SPAN and RSPAN destination ports function differently with VLAN tagging and encapsulation:
• For local SPAN, if the encapsulation replicate keywords are specified for the destination port, these
packets appear with the original encapsulation (untagged, ISL, or IEEE 802.1Q). If these keywords are
not specified, packets appear in the untagged format. Therefore, the output of a local SPAN session with
encapsulation replicate enabled can contain a mixture of untagged, ISL, or IEEE 802.1Q-tagged packets.
• For RSPAN, the original VLAN ID is lost because it is overwritten by the RSPAN VLAN identification.
Therefore, all packets appear on the destination port as untagged.

RSPAN VLAN
The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. RSPAN VLAN
has these special characteristics:
• All traffic in the RSPAN VLAN is always flooded.

Configuring SPAN and RSPAN

9
 Configuring SPAN and RSPAN
SPAN and RSPAN Interaction with Other Features

• No MAC address learning occurs on the RSPAN VLAN.

• RSPAN VLAN traffic only flows on trunk ports.
• RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN
configuration mode command.
• STP can run on RSPAN VLAN trunks but not on SPAN destination ports.
• An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.

For VLANs 1 to 1005 that are visible to VLAN Trunking Protocol (VTP), the VLAN ID and its associated
RSPAN characteristic are propagated by VTP. If you assign an RSPAN VLAN ID in the extended VLAN
range (1006 to 4094), you must manually configure all intermediate devices.
It is normal to have multiple RSPAN VLANs in a network at the same time with each RSPAN VLAN defining
a network-wide RSPAN session. That is, multiple RSPAN source sessions anywhere in the network can
contribute packets to the RSPAN session. It is also possible to have multiple RSPAN destination sessions
throughout the network, monitoring the same RSPAN VLAN and presenting traffic to the user. The RSPAN
VLAN ID separates the sessions.

SPAN and RSPAN Interaction with Other Features

SPAN interacts with these features:
• Routing—SPAN does not monitor routed traffic. VSPAN only monitors traffic that enters or exits the
device, not traffic that is routed between VLANs. For example, if a VLAN is being Rx-monitored and
the device routes traffic from another VLAN to the monitored VLAN, that traffic is not monitored and
not received on the SPAN destination port.
• STP—A destination port does not participate in STP while its SPAN or RSPAN session is active. The
destination port can participate in STP after the SPAN or RSPAN session is disabled. On a source port,
SPAN does not affect the STP status. STP can be active on trunk ports carrying an RSPAN VLAN.
• CDP—A SPAN destination port does not participate in CDP while the SPAN session is active. After the
SPAN session is disabled, the port again participates in CDP.
• VTP—You can use VTP to prune an RSPAN VLAN between devices.
• VLAN and trunking—You can modify VLAN membership or trunk settings for source or destination
ports at any time. However, changes in VLAN membership or trunk settings for a destination port do
not take effect until you remove the SPAN destination configuration. Changes in VLAN membership or
trunk settings for a source port immediately take effect, and the respective SPAN sessions automatically
adjust accordingly.
• EtherChannel—You can configure an EtherChannel group as a source port. When a group is configured
as a SPAN source, the entire group is monitored.
If a physical port is added to a monitored EtherChannel group, the new port is added to the SPAN source
port list. If a port is removed from a monitored EtherChannel group, it is automatically removed from
the source port list.
A physical port that belongs to an EtherChannel group can be configured as a SPAN source port and still
be a part of the EtherChannel. In this case, data from the physical port is monitored as it participates in
the EtherChannel. However, if a physical port that belongs to an EtherChannel group is configured as a
SPAN destination, it is removed from the group. After the port is removed from the SPAN session, it

Configuring SPAN and RSPAN

10
 Configuring SPAN and RSPAN
SPAN and RSPAN and Device Stacks

rejoins the EtherChannel group. Ports removed from an EtherChannel group remain members of the
group, but they are in the inactive or suspended state.
If a physical port that belongs to an EtherChannel group is a destination port and the EtherChannel group
is a source, the port is removed from the EtherChannel group and from the list of monitored ports.
• Multicast traffic can be monitored. For egress and ingress port monitoring, only a single unedited packet
is sent to the SPAN destination port. It does not reflect the number of times the multicast packet is sent.
• A private-VLAN port cannot be a SPAN destination port.
• A secure port cannot be a SPAN destination port.
For SPAN sessions, do not enable port security on ports with monitored egress when ingress forwarding
is enabled on the destination port. For RSPAN source sessions, do not enable port security on any ports
with monitored egress.
• An IEEE 802.1x port can be a SPAN source port. You can enable IEEE 802.1x on a port that is a SPAN
destination port; however, IEEE 802.1x is disabled until the port is removed as a SPAN destination.
For SPAN sessions, do not enable IEEE 802.1x on ports with monitored egress when ingress forwarding
is enabled on the destination port. For RSPAN source sessions, do not enable IEEE 802.1x on any ports
that are egress monitored.
• Starting with the Cisco IOS XE Cupertino 17.9.1 release, DHCP Snooping and Local SPAN can be
configured on the same VLAN for non-SDA deployments.

SPAN and RSPAN and Device Stacks

Because the stack of switches represents one logical switch, local SPAN source ports and destination ports
can be in different switches in the stack. Therefore, the addition or deletion of switches in the stack can affect
a local SPAN session, as well as an RSPAN source or destination session. An active session can become
inactive when a switch is removed from the stack or an inactive session can become active when a switch is
added to the stack.

Flow-Based SPAN
You can control the type of network traffic to be monitored in SPAN or RSPAN sessions by using flow-based
SPAN (FSPAN) or flow-based RSPAN (FRSPAN), which apply access control lists (ACLs) to the monitored
traffic on the source ports. The FSPAN ACLs can be configured to filter IPv4, IPv6, and non-IP monitored
traffic.
You apply an ACL to a SPAN session through the interface. It is applied to all the traffic that is monitored
on all interfaces in the SPAN [Link] packets that are permitted by this ACL are copied to the SPAN
destination port. No other packets are copied to the SPAN destination port.
The original traffic continues to be forwarded, and any port, VLAN, and router ACLs attached are applied.
The FSPAN ACL does not have any effect on the forwarding decisions. Similarly, the port, VLAN, and router
ACLs do not have any effect on the traffic monitoring. If a security input ACL denies a packet and it is not
forwarded, the packet is still copied to the SPAN destination ports if the FSPAN ACL permits it. But if the
security output ACL denies a packet and it is not sent, it is not copied to the SPAN destination ports. However,
if the security output ACL permits the packet to go out, it is only copied to the SPAN destination ports if the
FSPAN ACL permits it. This is also true for an RSPAN session.
You can attach three types of FSPAN ACLs to the SPAN session:
• IPv4 FSPAN ACL— Filters only IPv4 packets.

Configuring SPAN and RSPAN

11
 Configuring SPAN and RSPAN
Default SPAN and RSPAN Configuration

• IPv6 FSPAN ACL— Filters only IPv6 packets.

• MAC FSPAN ACL— Filters only non-IP packets.

If a VLAN-based FSPAN session configured on a stack cannot fit in the hardware memory on one or more
devices, it is treated as unloaded on those devices, and traffic meant for the FSPAN ACL and sourcing on
that device is not copied to the SPAN destination ports. The FSPAN ACL continues to be correctly applied,
and traffic is copied to the SPAN destination ports on the devices where the FSPAN ACL fits in the hardware
memory.
When an empty FSPAN ACL is attached, some hardware functions copy all traffic to the SPAN destination
ports for that ACL. If sufficient hardware resources are not available, even an empty FSPAN ACL can be
unloaded.

Default SPAN and RSPAN Configuration

Table 1: Default SPAN and RSPAN Configuration

Feature Default Setting

SPAN state (SPAN and RSPAN) Disabled.

Source port traffic to monitor Both received and sent traffic (both).

Encapsulation type (destination port) Native form (untagged packets).

Ingress forwarding (destination port) Disabled.

VLAN filtering On a trunk interface used as a source port, all VLANs are
monitored.

RSPAN VLANs None configured.

Configuring SPAN and RSPAN

SPAN Configuration Guidelines
• To remove a source or destination port or VLAN from the SPAN session, use the no monitor session
session_number source interface interface-id {interface interface-id | vlan vlan-id} global configuration
command or the no monitor session session_number destination interface interface-id global
configuration command. For destination interfaces, the encapsulation options are ignored with the no
form of the command.
• To monitor all VLANs on the trunk port, use the no monitor session session_number filter global
configuration command.

RSPAN Configuration Guidelines

• All the SPAN configuration guidelines apply to RSPAN.

Configuring SPAN and RSPAN

12
 Configuring SPAN and RSPAN
FSPAN and FRSPAN Configuration Guidelines

• As RSPAN VLANs have special properties, you should reserve a few VLANs across your network for
use as RSPAN VLANs; do not assign access ports to these VLANs.
• You can apply an output ACL to RSPAN traffic to selectively filter or monitor specific packets. Specify
these ACLs on the RSPAN VLAN in the RSPAN source device.
• For RSPAN configuration, you can distribute the source ports and the destination ports across multiple
devices in your network.
• Access ports (including voice VLAN ports) on the RSPAN VLAN are put in the inactive state.
• You can configure any VLAN as an RSPAN VLAN as long as these conditions are met:
• The same RSPAN VLAN is used for an RSPAN session in all the devices.
• All participating devices support RSPAN.

FSPAN and FRSPAN Configuration Guidelines

• When at least one FSPAN ACL is attached, FSPAN is enabled.
• When you attach at least one FSPAN ACL that is not empty to a SPAN session, and you have not attached
one or more of the other FSPAN ACLs (for instance, you have attached an IPv4 ACL that is not empty,
and have not attached IPv6 and MAC ACLs), FSPAN blocks the traffic that would have been filtered
by the unattached ACLs. Therefore, this traffic is not monitored.

How to Configure SPAN and RSPAN

The following sections provide information on how to configure SPAN and RSPAN.

Creating a Local SPAN Session

Follow these steps to create a SPAN session and specify the source (monitored) ports or VLANs and the
destination (monitoring) ports.

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Step 2 configure terminal Enters global configuration mode.

Example:

Device# configure terminal

Configuring SPAN and RSPAN

13
 Configuring SPAN and RSPAN
Creating a Local SPAN Session

Command or Action Purpose

Step 3 no monitor session {session_number | all | Removes any existing SPAN configuration for
local | remote} the session.
Example: • For session_number, the range is 1 to 66.

Device(config)# no monitor session all

• all—Removes all SPAN sessions.
• local—Removes all local sessions.
• remote—Removes all remote SPAN
sessions.

Step 4 monitor session session_number source Specifies the SPAN session and the source port
{interface interface-id | vlan vlan-id} [, | -] (monitored port).
[both | rx | tx]
• For session_number, the range is 1 to 66.
Example:
• For interface-id, specify the source port to
Device(config)# monitor session 1 source
monitor. Valid interfaces include physical
interface gigabitethernet1/0/1 interfaces and port-channel logical
interfaces (port-channel
port-channel-number). Valid port-channel
numbers are 1 to 48.
• For vlan-id, specify the source VLAN to
monitor. The range is 1 to 4094 (excluding
the RSPAN VLAN).
Note
A single session can include multiple
sources (ports or VLANs) defined in a
series of commands, but you cannot
combine source ports and source VLANs
in one session.

• (Optional) [, | -] Specifies a series or range

of interfaces. Enter a space before and after
the comma; enter a space before and after
the hyphen.
• (Optional) both | rx | tx—Specifies the
direction of traffic to monitor. If you do
not specify a traffic direction, the source
interface sends both sent and received
traffic.
• both—Monitors both received and
sent traffic.
• rx—Monitors received traffic.
• tx—Monitors sent traffic.
Note

Configuring SPAN and RSPAN

14
Configuring SPAN and RSPAN
Creating a Local SPAN Session

Command or Action Purpose

You can use the monitor session
session_number source command
multiple times to configure multiple
source ports.

Step 5 monitor session session_number destination Specifies the SPAN session and the destination
{interface interface-id [, | -] [encapsulation port (monitoring port). The port LED changes
{replicate | dot1q}]} to amber when the configuration changes take
effect. The LED returns to its original state
Example:
(green) only after removing the SPAN
destination configuration.
Device(config)# monitor session 1
destination interface Note
gigabitethernet1/0/2 encapsulation For local SPAN, you must use the same session
replicate
number for the source and destination
interfaces.

• For session_number, specify the session

number entered in step 4.
• For interface-id, specify the destination
port.
The destination interface must be a
physical port; it cannot be an
EtherChannel, and it cannot be a VLAN.
• (Optional) [, | -] Specifies a series or range
of interfaces. Enter a space before and after
the comma; enter a space before and after
the hyphen.

(Optional) encapsulation replicate specifies

that the destination interface replicates the
source interface encapsulation method. If not
selected, the default is to send packets in native
form (untagged).
(Optional) encapsulation dot1qspecifies that
the destination interface accepts the source
interface incoming packets with IEEE 802.1Q
encapsulation.
Note
You can use monitor session session_number
destination command multiple times to
configure multiple destination ports.

Step 6 end Returns to privileged EXEC mode.

Example:

Configuring SPAN and RSPAN

15
 Configuring SPAN and RSPAN
Creating a Local SPAN Session and Configuring Incoming Traffic

Command or Action Purpose

Device(config)# end

Step 7 show running-config Verifies your entries.

Example:

Device# show running-config

Step 8 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

Creating a Local SPAN Session and Configuring Incoming Traffic

Follow these steps to create a SPAN session, to specify the source ports or VLANs and the destination ports,
and to enable incoming traffic on the destination port for a network security device (such as a Cisco IDS
Sensor Appliance).

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Step 2 configure terminal Enters global configuration mode.

Example:

Device# configure terminal

Step 3 no monitor session {session_number | all | Removes any existing SPAN configuration for
local | remote} the session.
Example: • For session_number, the range is 1 to 66.

Device(config)# no monitor session all

• all—Removes all SPAN sessions.
• local—Removes all local sessions.
• remote—Removes all remote SPAN
sessions.

Configuring SPAN and RSPAN

16
Configuring SPAN and RSPAN
Creating a Local SPAN Session and Configuring Incoming Traffic

Command or Action Purpose

Step 4 monitor session session_number source Specifies the SPAN session and the source port
{interface interface-id | vlan vlan-id} [, | -] (monitored port).
[both | rx | tx]
Example:

Device(config)# monitor session 2 source

gigabitethernet1/0/1 rx

Step 5 monitor session session_number destination Specifies the SPAN session, the destination
{interface interface-id [, | -] [encapsulation port, the packet encapsulation, and the ingress
replicate] [ingress {dot1q vlan vlan-id | VLAN and encapsulation.
untagged vlan vlan-id | vlan vlan-id}]}
• For session_number, specify the session
Example: number entered in Step 4.

Device(config)# monitor session 2

• For interface-id, specify the destination
destination interface port.
gigabitethernet1/0/2 encapsulation
replicate ingress dot1q vlan 6
The destination interface must be a
physical port; it cannot be an
EtherChannel, and it cannot be a VLAN.
• (Optional) [, | -]—Specifies a series or
range of interfaces. Enter a space before
and after the comma or hyphen.
• (Optional) encapsulation replicate
specifies that the destination interface
replicates the source interface
encapsulation method. If not selected, the
default is to send packets in native form
(untagged).
• (Optional) encapsulation dot1qspecifies
that the destination interface accepts the
source interface incoming packets with
IEEE 802.1Q encapsulation.
• ingress enables forwarding of incoming
traffic on the destination port and to
specify the encapsulation type:
• dot1q vlan vlan-id—Accepts
incoming packets with IEEE 802.1Q
encapsulation with the specified
VLAN as the default VLAN.
• untagged vlan vlan-id or vlan
vlan-id—Accepts incoming packets
with untagged encapsulation type
with the specified VLAN as the
default VLAN.

Configuring SPAN and RSPAN

17
 Configuring SPAN and RSPAN
Specifying VLANs to Filter

Command or Action Purpose

Step 6 end Returns to privileged EXEC mode.
Example:

Device(config)# end

Step 7 show running-config Verifies your entries.

Example:

Device# show running-config

Step 8 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

Specifying VLANs to Filter

Follow these steps to limit SPAN source traffic to specific VLANs.

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Step 2 configure terminal Enters global configuration mode.

Example:

Device# configure terminal

Step 3 no monitor session {session_number | all | Removes any existing SPAN configuration for
local | remote} the session.
Example: • For session_number, the range is 1 to 66.

Device(config)# no monitor session all

• all—Removes all SPAN sessions.
• local—Removes all local sessions.
• remote—Removes all remote SPAN
sessions.

Configuring SPAN and RSPAN

18
Configuring SPAN and RSPAN
Specifying VLANs to Filter

Command or Action Purpose

Step 4 monitor session session_number source Specifies the characteristics of the source port
interface interface-id (monitored port) and SPAN session.
Example: • For session_number, the range is 1 to 66.

Device(config)# monitor session 2 source

• For interface-id, specify the source port to
interface gigabitethernet1/0/2 rx monitor. The interface specified must
already be configured as a trunk port.

Step 5 monitor session session_number filter vlan Limits the SPAN source traffic to specific
vlan-id [, | -] VLANs.
Example: • For session_number, enter the session
number specified in Step 4.
Device(config)# monitor session 2 filter
vlan 1 - 5 , 9 • For vlan-id, the range is 1 to 4094.
• (Optional) Use a comma (,) to specify a
series of VLANs, or use a hyphen (-) to
specify a range of VLANs. Enter a space
before and after the comma; enter a space
before and after the hyphen.

Step 6 monitor session session_number destination Specifies the SPAN session and the destination
{interface interface-id [, | -] [encapsulation port (monitoring port).
replicate]}
• For session_number, specify the session
Example: number entered in Step 4.

Device(config)# monitor session 2

• For interface-id, specify the destination
destination interface port.
gigabitethernet1/0/1
The destination interface must be a
physical port; it cannot be an
EtherChannel, and it cannot be a VLAN.
• (Optional) [, | -] Specifies a series or range
of interfaces. Enter a space before and after
the comma; enter a space before and after
the hyphen.
• (Optional) encapsulation replicate
specifies that the destination interface
replicates the source interface
encapsulation method. If not selected, the
default is to send packets in native form
(untagged).

Step 7 end Returns to privileged EXEC mode.

Example:

Device(config)# end

Configuring SPAN and RSPAN

19
 Configuring SPAN and RSPAN
Configuring a VLAN as an RSPAN VLAN

Command or Action Purpose

Step 8 show running-config Verifies your entries.
Example:

Device# show running-config

Step 9 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

Configuring a VLAN as an RSPAN VLAN

Follow these steps to create a new VLAN, then configure it to be the RSPAN VLAN for the RSPAN session.

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Step 2 configure terminal Enters global configuration mode.

Example:

Device# configure terminal

Step 3 vlan vlan-id Enters a VLAN ID to create a VLAN, or enters

the VLAN ID of an existing VLAN, and enters
Example:
VLAN configuration mode. The range is 2 to
1001 and 1006 to 4094.
Device(config)# vlan 100
The RSPAN VLAN cannot be VLAN 1 (the
default VLAN) or VLAN IDs 1002 through
1005 (reserved for Token Ring and FDDI
VLANs).

Step 4 remote-span Configures the VLAN as an RSPAN VLAN.

Example:

Device(config-vlan)# remote-span

Configuring SPAN and RSPAN

20
 Configuring SPAN and RSPAN
Creating an RSPAN Source Session

Command or Action Purpose

Step 5 end Returns to privileged EXEC mode.
Example:

Device(config-vlan)# end

Step 6 show running-config Verifies your entries.

Example:

Device# show running-config

Step 7 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

What to do next
You must create the RSPAN VLAN in all devices that will participate in RSPAN. If the RSPAN VLAN-ID
is in the normal range (lower than 1005) and VTP is enabled in the network, you can create the RSPAN VLAN
in one device, and VTP propagates it to the other devices in the VTP domain. For extended-range VLANs
(greater than 1005), you must configure RSPAN VLAN on both source and destination devices and any
intermediate devices.
Use VTP pruning to get an efficient flow of RSPAN traffic, or manually delete the RSPAN VLAN from all
trunks that do not need to carry the RSPAN traffic.
To remove the remote SPAN characteristic from a VLAN and convert it back to a normal VLAN, use the no
remote-span VLAN configuration command.
To remove a source port or VLAN from the SPAN session, use the no monitor session session_number
source {interface interface-id | vlan vlan-id} global configuration command. To remove the RSPAN VLAN
from the session, use the no monitor session session_number destination remote vlan vlan-id.

Creating an RSPAN Source Session

Follow these steps to create and start an RSPAN source session and to specify the monitored source and the
destination RSPAN VLAN.

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Configuring SPAN and RSPAN

21
 Configuring SPAN and RSPAN
Creating an RSPAN Source Session

Command or Action Purpose

Step 2 configure terminal Enters global configuration mode.
Example:

Device# configure terminal

Step 3 no monitor session {session_number | all | Removes any existing SPAN configuration for
local | remote} the session.
Example: • For session_number, the range is 1 to 66.

Device(config)# no monitor session 1

• all—Removes all SPAN sessions.
• local—Removes all local sessions.
• remote—Removes all remote SPAN
sessions.

Step 4 monitor session session_number source Specifies the RSPAN session and the source
{interface interface-id | vlan vlan-id} [, | -] port (monitored port).
[both | rx | tx]
• For session_number, the range is 1 to 66.
Example:
• Enter a source port or source VLAN for
Device(config)# monitor session 1 source
the RSPAN session:
interface gigabitethernet1/0/1 tx • For interface-id, specifies the source
port to monitor. Valid interfaces
include physical interfaces and
port-channel logical interfaces
(port-channel port-channel-number).
Valid port-channel numbers are 1 to
48.
• For vlan-id, specifies the source
VLAN to monitor. The range is 1 to
4094 (excluding the RSPAN VLAN).
A single session can include multiple
sources (ports or VLANs), defined in
a series of commands, but you cannot
combine source ports and source
VLANs in one session.

• (Optional) [, | -]—Specifies a series or

range of interfaces. Enter a space before
and after the comma; enter a space before
and after the hyphen.
• (Optional) both | rx | tx—Specifies the
direction of traffic to monitor. If you do
not specify a traffic direction, the source

Configuring SPAN and RSPAN

22
 Configuring SPAN and RSPAN
Specifying VLANs to Filter

Command or Action Purpose

interface sends both sent and received
traffic.
• both—Monitors both received and
sent traffic.
• rx—Monitors received traffic.
• tx—Monitors sent traffic.

Step 5 monitor session session_number destination Specifies the RSPAN session, the destination
remote vlan vlan-id RSPAN VLAN, and the destination-port group.
Example: • For session_number, enter the number
defined in Step 4.
Device(config)# monitor session 1
destination remote vlan 100 • For vlan-id, specify the source RSPAN
VLAN to monitor.

Step 6 end Returns to privileged EXEC mode.

Example:

Device(config)# end

Step 7 show running-config Verifies your entries.

Example:

Device# show running-config

Step 8 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

Specifying VLANs to Filter

Follow these steps to configure the RSPAN source session to limit RSPAN source traffic to specific VLANs.

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Configuring SPAN and RSPAN

23
 Configuring SPAN and RSPAN
Specifying VLANs to Filter

Command or Action Purpose

Step 2 configure terminal Enters global configuration mode.
Example:

Device# configure terminal

Step 3 no monitor session {session_number | all | Removes any existing SPAN configuration for
local | remote} the session.
Example: • For session_number, the range is 1 to 66.

Device(config)# no monitor session 2

• all—Removes all SPAN sessions.
• local—Removes all local sessions.
• remote—Removes all remote SPAN
sessions.

Step 4 monitor session session_number source Specifies the characteristics of the source port
interface interface-id (monitored port) and SPAN session.
Example: • For session_number, the range is 1 to 66.

Device(config)# monitor session 2 source

• For interface-id, specify the source port to
interface gigabitethernet1/0/2 rx monitor. The interface specified must
already be configured as a trunk port.

Step 5 monitor session session_number filter vlan Limits the SPAN source traffic to specific
vlan-id [, | -] VLANs.
Example: • For session_number, enter the session
number specified in step 4.
Device(config)# monitor session 2 filter
vlan 1 - 5 , 9 • For vlan-id, the range is 1 to 4094.
• (Optional) , | - Use a comma (,) to specify
a series of VLANs or use a hyphen (-) to
specify a range of VLANs. Enter a space
before and after the comma; enter a space
before and after the hyphen.

Step 6 monitor session session_number destination Specifies the RSPAN session and the
remote vlan vlan-id destination remote VLAN (RSPAN VLAN).
Example: • For session_number, enter the session
number specified in Step 4.
Device(config)# monitor session 2
destination remote vlan 902 • For vlan-id, specify the RSPAN VLAN to
carry the monitored traffic to the
destination port.

Configuring SPAN and RSPAN

24
 Configuring SPAN and RSPAN
Creating an RSPAN Destination Session

Command or Action Purpose

Step 7 end Returns to privileged EXEC mode.
Example:

Device(config)# end

Step 8 show running-config Verifies your entries.

Example:

Device# show running-config

Step 9 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

Creating an RSPAN Destination Session

You configure an RSPAN destination session on a different device or device stack; that is, not the device or
device stack on which the source session was configured.
Follow these steps to define the RSPAN VLAN on that device, to create an RSPAN destination session, and
to specify the source RSPAN VLAN and the destination port.

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Step 2 configure terminal Enters global configuration mode.

Example:

Device# configure terminal

Step 3 vlan vlan-id Specifies the VLAN ID of the RSPAN VLAN

created from the source device, and enters
Example:
VLAN configuration mode.
Device(config)# vlan 901 If both devices are participating in VTP and
the RSPAN VLAN ID is from 2 to 1005, Steps
3 through 5 are not required because the

Configuring SPAN and RSPAN

25
 Configuring SPAN and RSPAN
Creating an RSPAN Destination Session

Command or Action Purpose

RSPAN VLAN ID is propagated through the
VTP network.

Step 4 remote-span Identifies the VLAN as the RSPAN VLAN.

Example:

Device(config-vlan)# remote-span

Step 5 exit Returns to global configuration mode.

Example:

Device(config-vlan)# exit

Step 6 no monitor session {session_number | all | Removes any existing SPAN configuration for
local | remote} the session.
Example: • For session_number, the range is 1 to 66.

Device(config)# no monitor session 1

• all—Removes all SPAN sessions.
• local—Removes all local sessions.
• remote—Removes all remote SPAN
sessions.

Step 7 monitor session session_number source Specifies the RSPAN session and the source
remote vlan vlan-id RSPAN VLAN.
Example: • For session_number, the range is 1 to 66.

Device(config)# monitor session 1 source

• For vlan-id, specify the source RSPAN
remote vlan 901 VLAN to monitor.

Step 8 monitor session session_number destination Specifies the RSPAN session and the
interface interface-id destination interface.
Example: • For session_number, enter the number
defined in Step 7.
Device(config)# monitor session 1
destination interface In an RSPAN destination session, you
gigabitethernet2/0/1 must use the same session number for the
source RSPAN VLAN and the destination
port.
• For interface-id, specify the destination
interface. The destination interface must
be a physical interface.
• Though visible in the command-line help
string, encapsulation replicate is not
supported for RSPAN. The original
VLAN ID is overwritten by the RSPAN

Configuring SPAN and RSPAN

26
 Configuring SPAN and RSPAN
Creating an RSPAN Destination Session and Configuring Incoming Traffic

Command or Action Purpose

VLAN ID, and all packets appear on the
destination port as untagged.

Step 9 end Returns to privileged EXEC mode.

Example:

Device(config)# end

Step 10 show running-config Verifies your entries.

Example:

Device# show running-config

Step 11 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

Creating an RSPAN Destination Session and Configuring Incoming Traffic

Follow these steps to create an RSPAN destination session, to specify the source RSPAN VLAN and the
destination port, and to enable incoming traffic on the destination port for a network security device (such as
a Cisco IDS Sensor Appliance).

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Step 2 configure terminal Enters global configuration mode.

Example:

Device# configure terminal

Step 3 no monitor session {session_number | all | Removes any existing SPAN configuration for
local | remote} the session.
Example: • For session_number, the range is 1 to 66.

Device(config)# no monitor session 2

• all—Removes all SPAN sessions.

Configuring SPAN and RSPAN

27
 Configuring SPAN and RSPAN
Creating an RSPAN Destination Session and Configuring Incoming Traffic

Command or Action Purpose

• local—Removes all local sessions.
• remote—Removes all remote SPAN
sessions.

Step 4 monitor session session_number source Specifies the RSPAN session and the source
remote vlan vlan-id RSPAN VLAN.
Example: • For session_number, the range is 1 to 66.

Device(config)# monitor session 2 source

• For vlan-id, specify the source RSPAN
remote vlan 901 VLAN to monitor.

Step 5 monitor session session_number destination Specifies the SPAN session, the destination
{interface interface-id [, | -] [ingress {dot1q port, the packet encapsulation, and the incoming
vlan vlan-id | untagged vlan vlan-id | vlan VLAN and encapsulation.
vlan-id}]}
• For session_number, enter the number
Example: defined in Step 5.
In an RSPAN destination session, you
Device(config)# monitor session 2
destination interface must use the same session number for the
gigabitethernet1/0/2 ingress vlan 6 source RSPAN VLAN and the destination
port.
• For interface-id, specify the destination
interface. The destination interface must
be a physical interface.
• Though visible in the command-line help
string, encapsulation replicate is not
supported for RSPAN. The original VLAN
ID is overwritten by the RSPAN VLAN
ID, and all packets appear on the
destination port as untagged.
• (Optional) [, | -] Specifies a series or range
of interfaces. Enter a space before and after
the comma; enter a space before and after
the hyphen.
• Enter ingress with additional keywords to
enable forwarding of incoming traffic on
the destination port and to specify the
encapsulation type:
• dot1q vlan vlan-id—Forwards
incoming packets with IEEE 802.1Q
encapsulation with the specified
VLAN as the default VLAN.
• untagged vlan vlan-id or vlan
vlan-id—Forwards incoming packets
with untagged encapsulation type

Configuring SPAN and RSPAN

28
 Configuring SPAN and RSPAN
Configuring an FSPAN Session

Command or Action Purpose

with the specified VLAN as the
default VLAN.

Step 6 end Returns to privileged EXEC mode.

Example:

Device(config)# end

Step 7 show running-config Verifies your entries.

Example:

Device# show running-config

Step 8 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

Configuring an FSPAN Session

Follow these steps to create a SPAN session, specify the source (monitored) ports or VLANs and the destination
(monitoring) ports, and configure FSPAN for the session.

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Step 2 configure terminal Enters global configuration mode.

Example:

Device# configure terminal

Step 3 no monitor session {session_number | all | Removes any existing SPAN configuration for
local | remote} the session.
Example: • For session_number, the range is 1 to 66.

Device(config)# no monitor session 2

• all—Removes all SPAN sessions.
• local—Removes all local sessions.

Configuring SPAN and RSPAN

29
 Configuring SPAN and RSPAN
Configuring an FSPAN Session

Command or Action Purpose

• remote—Removes all remote SPAN
sessions.

Step 4 monitor session session_number source Specifies the SPAN session and the source port
{interface interface-id | vlan vlan-id} [, | -] (monitored port).
[both | rx | tx]
• For session_number, the range is 1 to 66.
Example:
• For interface-id, specifies the source port
Device(config)# monitor session 2 source
to monitor. Valid interfaces include
interface gigabitethernet1/0/1 physical interfaces and port-channel logical
interfaces (port-channel
port-channel-number). Valid port-channel
numbers are 1 to 48.
• For vlan-id, specify the source VLAN to
monitor. The range is 1 to 4094 (excluding
the RSPAN VLAN).
Note
A single session can include multiple
sources (ports or VLANs) defined in a
series of commands, but you cannot
combine source ports and source VLANs
in one session.

• (Optional) [, | -]—Specifies a series or

range of interfaces. Enter a space before
and after the comma; enter a space before
and after the hyphen.
• (Optional) [both | rx | tx]—Specifies the
direction of traffic to monitor. If you do
not specify a traffic direction, the SPAN
monitors both sent and received traffic.
• both—Monitors both sent and
received traffic. This is the default.
• rx—Monitors received traffic.
• tx—Monitors sent traffic.
Note
You can use the monitor session
session_number source command
multiple times to configure multiple
source ports.

Step 5 monitor session session_number destination Specifies the SPAN session and the destination
{interface interface-id [, | -] [encapsulation port (monitoring port).
replicate]}

Configuring SPAN and RSPAN

30
Configuring SPAN and RSPAN
Configuring an FSPAN Session

Command or Action Purpose

Example: • For session_number, specify the session
number entered in Step 4.
Device(config)# monitor session 2
destination interface • For destination, specify the following
gigabitethernet1/0/2 encapsulation parameters:
replicate
• For interface-id, specify the
destination port.
The destination interface must be a
physical port; it cannot be an
EtherChannel, and it cannot be a
VLAN.
• (Optional) [, | -] Specifies a series or
range of interfaces. Enter a space
before and after the comma; enter a
space before and after the hyphen.
• (Optional) encapsulation replicate
specifies that the destination interface
replicates the source interface
encapsulation method. If not selected,
the default is to send packets in native
form (untagged).

Note
For local SPAN, you must use the same session
number for the source and destination
interfaces.
You can use monitor session session_number
destination command multiple times to
configure multiple destination ports.

Step 6 monitor session session_number filter {ip | Specifies the SPAN session, the types of packets
ipv6 | mac} access-group {access-list-number to filter, and the ACLs to use in an FSPAN
| name} session.
Example: • For session_number, specify the session
number entered in Step 4.
Device(config)# monitor session 2 filter
ipv6 access-group 4 • For access-list-number, specify the ACL
number that you want to use to filter
traffic.
• For name, specify the ACL name that you
want to use to filter traffic.

Step 7 end Returns to privileged EXEC mode.

Example:

Configuring SPAN and RSPAN

31
 Configuring SPAN and RSPAN
Configuring an FRSPAN Session

Command or Action Purpose

Device(config)# end

Step 8 show running-config Verifies your entries.

Example:

Device# show running-config

Step 9 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

Configuring an FRSPAN Session

Follow these steps to start an RSPAN source session, specify the monitored source and the destination RSPAN
VLAN, and configure FRSPAN for the session.

Procedure

Command or Action Purpose

Step 1 enable Enables privileged EXEC mode.
Example: • Enter your password if prompted.
Device> enable

Step 2 configure terminal Enters global configuration mode.

Example:

Device# configure terminal

Step 3 no monitor session {session_number | all | Removes any existing SPAN configuration for
local | remote} the session.
Example: • For session_number, the range is 1 to 66.

Device(config)# no monitor session 2

• all—Removes all SPAN sessions.
• local—Removes all local sessions.
• remote—Removes all remote SPAN
sessions.

Step 4 monitor session session_number source Specifies the SPAN session and the source port
{interface interface-id | vlan vlan-id} [, | -] (monitored port).
[both | rx | tx]
• For session_number, the range is 1 to 66.

Configuring SPAN and RSPAN

32
Configuring SPAN and RSPAN
Configuring an FRSPAN Session

Command or Action Purpose

Example: • For interface-id, specifies the source port
to monitor. Valid interfaces include
Device(config)# monitor session 2 source physical interfaces and port-channel
interface gigabitethernet1/0/1 logical interfaces (port-channel
port-channel-number). Valid port-channel
numbers are 1 to 48.
• For vlan-id, specify the source VLAN to
monitor. The range is 1 to 4094
(excluding the RSPAN VLAN).
Note
A single session can include multiple
sources (ports or VLANs) defined in a
series of commands, but you cannot
combine source ports and source VLANs
in one session.

• (Optional) [, | -]—Specifies a series or

range of interfaces. Enter a space before
and after the comma; enter a space before
and after the hyphen.
• (Optional) [both | rx | tx]—Specifies the
direction of traffic to monitor. If you do
not specify a traffic direction, the SPAN
monitors both sent and received traffic.
• both—Monitors both sent and received
traffic. This is the default.
• rx—Monitors received traffic.
• tx—Monitors sent traffic.
Note
You can use the monitor session
session_number source command
multiple times to configure multiple
source ports.

Step 5 monitor session session_number destination Specifies the RSPAN session and the
remote vlan vlan-id destination RSPAN VLAN.
Example: • For session_number, enter the number
defined in Step 4.
Device(config)# monitor session 2
destination remote vlan 5 • For vlan-id, specify the destination
RSPAN VLAN to monitor.

Configuring SPAN and RSPAN

33
 Configuring SPAN and RSPAN
Configuring an FRSPAN Session

Command or Action Purpose

Step 6 vlan vlan-id Enters the VLAN configuration mode. For
vlan-id, specify the source RSPAN VLAN to
Example:
monitor.
Device(config)# vlan 10

Step 7 remote-span Specifies that the VLAN you specified in Step

5 is part of the RSPAN VLAN.
Example:

Device(config-vlan)# remote-span

Step 8 exit Returns to global configuration mode.

Example:

Device(config-vlan)# exit

Step 9 monitor session session_number filter {ip | Specifies the RSPAN session, the types of
ipv6 | mac} access-group {access-list-number packets to filter, and the ACLs to use in an
| name} FRSPAN session.
Example: • For session_number, specify the session
number entered in Step 4.
Device(config)# monitor session 2 filter
ip access-group 7 • For access-list-number, specify the ACL
number that you want to use to filter
traffic.
• For name, specify the ACL name that you
want to use to filter traffic.

Step 10 end Returns to privileged EXEC mode.

Example:

Device(config)# end

Step 11 show running-config Verifies your entries.

Example:

Device# show running-config

Step 12 copy running-config startup-config (Optional) Saves your entries in the

configuration file.
Example:

Device# copy running-config

startup-config

Configuring SPAN and RSPAN

34
 Configuring SPAN and RSPAN
Monitoring SPAN and RSPAN Operations

Monitoring SPAN and RSPAN Operations

The following table describes the command used to display SPAN and RSPAN operations configuration and
results to monitor operations:

Table 2: Monitoring SPAN and RSPAN Operations

Command Purpose
show monitor Displays the current SPAN
configuration.

Configuration Examples for SPAN and RSPAN

The following sections provide configuration examples for SPAN and RSPAN

Example: Configuring Local SPAN

This example shows how to set up SPAN session 1 for monitoring source port traffic to a destination port.
First, any existing SPAN configuration for session 1 is deleted, and then bidirectional traffic is mirrored from
source Gigabit Ethernet port 1 to destination Gigabit Ethernet port 2, retaining the encapsulation method.

Device> enable
Device# configure terminal
Device(config)# no monitor session 1
Device(config)# monitor session 1 source interface gigabitethernet1/0/1
Device(config)# monitor session 1 destination interface gigabitethernet1/0/2
encapsulation replicate
Device(config)# end

This example shows how to remove port 1 as a SPAN source for SPAN session 1:

Device> enable
Device# configure terminal
Device(config)# no monitor session 1 source interface gigabitethernet1/0/1
Device(config)# end

This example shows how to disable received traffic monitoring on port 1, which was configured for bidirectional
monitoring:

Device> enable
Device# configure terminal
Device(config)# no monitor session 1 source interface gigabitethernet1/0/1 rx

The monitoring of traffic received on port 1 is disabled, but traffic sent from this port continues to be monitored.
This example shows how to remove any existing configuration on SPAN session 2, configure SPAN session
2 to monitor received traffic on all ports belonging to VLANs 1 through 3, and send it to destination Gigabit
Ethernet port 2. The configuration is then modified to also monitor all traffic on all ports belonging to VLAN
10.

Configuring SPAN and RSPAN

35
 Configuring SPAN and RSPAN
Examples: Creating an RSPAN VLAN

Device> enable
Device# configure terminal
Device(config)# no monitor session 2
Device(config)# monitor session 2 source vlan 1 - 3 rx

Device(config)# monitor session 2 destination interface gigabitethernet1/0/2

Device(config)# monitor session 2 source vlan 10
Device(config)# end

This example shows how to remove any existing configuration on SPAN session 2, configure SPAN session
2 to monitor received traffic on Gigabit Ethernet source port 1, and send it to destination Gigabit Ethernet
port 2 with the same egress encapsulation type as the source port, and to enable ingress forwarding with VLAN
6 as the default ingress VLAN:

Device> enable
Device# configure terminal
Device(config)# no monitor session 2
Device(config)# monitor session 2 source gigabitethernet0/1 rx
Device(config)# monitor session 2 destination interface gigabitethernet0/2 encapsulation
replicate ingress vlan 6
Device(config)# end

This example shows how to remove any existing configuration on SPAN session 2, configure SPAN session
2 to monitor traffic received on Gigabit Ethernet trunk port 2, and send traffic for only VLANs 1 through 5
and VLAN 9 to destination Gigabit Ethernet port 1:

Device> enable
Device# configure terminal
Device(config)# no monitor session 2
Device(config)# monitor session 2 source interface gigabitethernet1/0/2 rx
Device(config)# monitor session 2 filter vlan 1 - 5 , 9
Device(config)# monitor session 2 destination interface gigabitethernet1/0/1
Device(config)# end

Examples: Creating an RSPAN VLAN

This example shows how to create the RSPAN VLAN 901:

Device> enable
Device# configure terminal
Device(config)# vlan 901
Device(config-vlan)# remote span
Device(config-vlan)# end

This example shows how to remove any existing RSPAN configuration for session 1, configure RSPAN
session 1 to monitor multiple source interfaces, and configure the destination as RSPAN VLAN 901:

Device> enable
Device# configure terminal
Device(config)# no monitor session 1
Device(config)# monitor session 1 source interface gigabitethernet1/0/1 tx
Device(config)# monitor session 1 source interface gigabitethernet1/0/2 rx
Device(config)# monitor session 1 source interface port-channel 2
Device(config)# monitor session 1 destination remote vlan 901
Device(config)# end

Configuring SPAN and RSPAN

36
 Configuring SPAN and RSPAN
Feature History for SPAN and RSPAN

This example shows how to remove any existing configuration on RSPAN session 2, configure RSPAN
session 2 to monitor traffic received on trunk port 2, and send traffic for only VLANs 1 through 5 and 9 to
destination RSPAN VLAN 902:

Device> enable
Device# configure terminal
Device(config)# no monitor session 2
Device(config)# monitor session 2 source interface gigabitethernet1/0/2 rx
Device(config)# monitor session 2 filter vlan 1 - 5 , 9
Device(config)# monitor session 2 destination remote vlan 902
Device(config)# end

This example shows how to configure VLAN 901 as the source remote VLAN and port 1 as the destination
interface:

Device> enable
Device# configure terminal
Device(config)# monitor session 1 source remote vlan 901
Device(config)# monitor session 1 destination interface gigabitethernet2/0/1
Device(config)# end

This example shows how to configure VLAN 901 as the source remote VLAN in RSPAN session 2, to
configure Gigabit Ethernet source port 2 as the destination interface, and to enable forwarding of incoming
traffic on the interface with VLAN 6 as the default receiving VLAN:

Device> enable
Device# configure terminal
Device(config)# monitor session 2 source remote vlan 901
Device(config)# monitor session 2 destination interface gigabitethernet1/0/2 ingress vlan 6
Device(config)# end

Feature History for SPAN and RSPAN

This table provides release and related information for the features explained in this module.
These features are available in all the releases subsequent to the one they were introduced in, unless
notedotherwise.

Configuring SPAN and RSPAN

37
 Configuring SPAN and RSPAN
Feature History for SPAN and RSPAN

Release Feature Feature Information

Cisco IOS XE Everest 16.5.1a Switch Port Analyzer (SPAN) Switch Port Analyzer allows
monitoring of device traffic on a
port or VLAN using a
sniffer/analyzer or RMON probe.

Flow-based Switch Port Analyzer Flow-based SPAN provides a

(SPAN) method to capture only required
data between end hosts by using
specified filters. The filters are
defined in terms of access lists that
limit IPv4, IPv6 or IPv4 + IPv6, or
non-IP traffic (MAC) between
specified source and destination
addresses.

Switch Port Analyzer (SPAN) - The feature provides distributed

distributed egress SPAN egress SPAN functionality onto line
cards in conjunction with ingress
SPAN already been distributed to
line cards. By distributing egress
SPAN functionalities onto line
cards, the performance of the
system is improved.

Cisco IOS XE Cupertino 17.9.1 DHCP Snooping and Local SPAN DHCP Snooping and Local SPAN
can be configured on the same
VLAN for non-SDA deployments.

Use the Cisco Feature Navigator to find information about platform and software image support. To access
Cisco Feature Navigator, go to [Link]

Configuring SPAN and RSPAN

38