Status and Statistics
Switched Port Analyzer (SPAN and RSPAN)
Cisco 350, 350X and 550X Series Managed Switches, Firmware Release 2.4, ver 0.4 65
5
Remote SPAN
RSPAN extends SPAN by enabling monitoring of multiple switches across your network and
allowing the analyzer port to be defined on a remote switch. In addition to the start (source)
and final (destination) switches, you can define intermediate switches over which the traffic
flows, as shown in Figure 1.
Figure 1 RSPAN Switch Deployment:
The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is
dedicated for that RSPAN session in all participating switches. The traffic from the source
interfaces on the start device is copied to the RSPAN VLAN through a reflector port and then
forwarded over trunk ports on the intermediate devices to the destination session on the final
switch, which is monitoring the RSPAN VLAN.
The reflector port is the mechanism that copies packets to an RSPAN VLAN. It is a network
port that handles various types of traffic.
The RSPAN VLAN must be configured on all the intermediate switches.
NOTE RSPAN does not always successfully copy all the packets when they are arrive from multiple
sources simultaneously. If accurate monitoring is required, the TCAM-based mirror policy can
be used.
RSPAN Workflow
The following workflow describes how to configure the start, intermediate and final switches:
• Start Switch
• Intermediate Switch(es)
• Final Switch
Start Switch
Intermediate
Switch(es)
231 4 Final Switch 87
Define RSPAN VLAN
(ex. 10)
Define RSPAN VLAN
10 with port 2 and 3 as
members
Define RSPAN VLAN
10, with port 7 as
member but not port 8
Source
Port
Reflector
Port
Source
Port
Analyzer
Port
To Next Page
Loading...
Need help?
General
