Chapter 12: Switch Management 207
Section 12-3
The source of traffic for the SPAN session can be either switch ports or VLANs. If
switch ports are to be monitored, they are identified as src-interface (only a single
interface type and number).
If a VLANs is to be monitored, it is identified as src-vlan.
The SPAN destination port, where the monitoring device is connected, is selected by
the interface dest-interface command before the port monitor command is applied.
The destination port must belong to the same VLAN as the source.
Switches inherently monitor traffic in both directions.
■ Select the source and destination.
a. Select the session source:
(global) monitor session session {source {interface interface} | {vlan
vlan-id}} [, | - | rx | tx | both]
The SPAN session is uniquely identified by session (1 or 2). The source can be
an interface (an interface type and number or a port-channel number) or a
VLAN number vlan-id (1 to 1005). Multiple source VLANs can be given by
using the vlan keyword followed by vlan-id numbers separated by commas (,).
To specify a range of VLAN numbers, use the vlan keyword followed by the
first and last vlan-id numbers, separated by a dash (-).
■ Source traffic to be monitored can be one of rx (traffic received at the source),
tx (traffic transmitted from the source), or both (the default).
b. Select the session destination:
(global) monitor session session {destination {interface interface} [, |
-] | {vlan vlan-id}}
The destination for the SPAN session (session number 1 or 2) can be an
interface (interface type and number) or a VLAN number vlan-id (1 to 1005).
Multiple destinations can also be specified, if needed. These can be given with
the interface keyword, followed by a list of interface numbers separated by
commas (,). To specify a range of interfaces, use the interface keyword followed
by the first and last interface numbers, separated by a dash (-).
c. (Optional) Filter VLANs on a trunk source:
(global) monitor session session filter vlan vlan-id} [, | -]
If a trunk is used as a source port, you can filter the trunk to select specific
VLANs to be monitored. A VLAN number is identified as vlan-id (1 to 1005).
Multiple source VLANs can be given with the vlan keyword, followed by a list
of vlan-id numbers separated by commas (,). To specify a range of VLANs, use
the vlan keyword followed by the first and last vlan-id numbers, separated by a
dash (-).