Skip to content
Log in Sign up My account

4.3 SPAN, RSPAN and ERSPAN

Blueprint 4.3: Configure SPAN/RSPAN/ERSPAN

  • Local SPAN: source ports or VLANs, direction, destination port behaviour
  • RSPAN: the remote-span VLAN, source switch, intermediate switches, destination switch
  • ERSPAN: GRE-encapsulated mirroring across a routed network, source and destination sessions
  • Verification with show monitor session
  • Embedded Packet Capture as an on-box alternative on routers

The verb is configure. Expect to complete or correct monitor session configurations, and to choose the right flavour for a topology.

Why port mirroring

A switch forwards a unicast frame only to the port where the destination lives, so an analyzer plugged into a random port sees almost nothing. SPAN (Switched Port Analyzer) tells the switch to send a copy of selected traffic to a destination port, where an analyzer, IDS or capture appliance listens.

Flavour Source and destination Transport of the copies Typical use
Local SPAN Same switch Switch backplane Analyzer plugged into the same switch
RSPAN Different switches, same Layer 2 domain A dedicated remote-span VLAN over trunks Central analyzer in the same campus
ERSPAN Anywhere with IP reachability GRE tunnel across a routed network Analyzer in a data center, or a Wireshark host across the WAN 
graph LR
  subgraph L ["Local SPAN"]
    S1["Source Gi1/0/1"] --> SW["SW1"] --> A1["Analyzer Gi1/0/24"]
  end
  subgraph R ["RSPAN"]
    S2["Source port"] --> SWA["Source switch"] -->|"VLAN 900 remote-span"| SWM["Intermediate"] -->|"VLAN 900"| SWB["Destination switch"] --> A2["Analyzer"]
  end
  subgraph E ["ERSPAN"]
    S3["Source port"] --> RA["Source device"] -->|"GRE over IP"| RB["Destination device or analyzer"]
  end

Terminology

Term Meaning
Source port A port whose traffic is copied. Can be an access port, a trunk or an EtherChannel.
Source VLAN (VSPAN) Every port in the VLAN is a source
Direction rx (received), tx (transmitted) or both. The default is both.
Destination port The port the copies are sent out of. It becomes a dedicated monitoring port.
Filter VLAN When a trunk is a source, limits the copy to selected VLANs
Session A numbered monitor session binding sources to a destination

Local SPAN

monitor session 1 source interface GigabitEthernet1/0/1 - 3 rx
monitor session 1 source interface GigabitEthernet1/0/10 both
monitor session 1 destination interface GigabitEthernet1/0/24

Mirroring a VLAN or a trunk:

monitor session 2 source vlan 10 , 20 rx
monitor session 2 destination interface GigabitEthernet1/0/23
!
monitor session 3 source interface GigabitEthernet1/0/48
monitor session 3 filter vlan 10
monitor session 3 destination interface GigabitEthernet1/0/22 encapsulation replicate

Destination port behaviour on Catalyst switches:

  • It stops acting as a normal switch port. It does not forward received traffic unless you add the ingress option, and it does not participate in Layer 2 protocols such as STP, DTP, CDP or PAgP.
  • By default, copies are sent untagged. encapsulation replicate keeps the original 802.1Q tags (and other encapsulation), which the analyzer needs to tell VLANs apart.
  • A destination port cannot also be a source port, and cannot be an EtherChannel member.
  • A port can be the destination of only one session.

Exam trap

Oversubscription is real. Mirroring both directions of a full-duplex 1 Gbps port can generate up to 2 Gbps of copies, which a 1 Gbps destination port cannot carry. The switch drops the excess copies, never the production traffic. If the analyzer misses packets, mirror rx only, or use a faster destination port.

Exam trap

On Catalyst switches, a single session can have several source ports or several source VLANs, but not a mix of source ports and source VLANs. Use two sessions if you need both.

RSPAN

RSPAN replaces the destination port with a VLAN. The source switch floods the copies into that VLAN, trunks carry it, and the destination switch pulls the copies out of the VLAN and sends them to the analyzer.

graph LR
  SRV["Server"] -- "Gi1/0/5 source" --- SW1["SW1 source switch"]
  SW1 -- "Gi1/0/48 trunk allows 900" --- SW2["SW2 intermediate"]
  SW2 -- "Gi1/0/47 trunk allows 900" --- SW3["SW3 destination switch"]
  SW3 -- "Gi1/0/24" --- ANA["Analyzer"]
vlan 900
 name RSPAN
 remote-span
!
interface GigabitEthernet1/0/48
 switchport trunk allowed vlan add 900

monitor session 1 source interface GigabitEthernet1/0/5 both
monitor session 1 destination remote vlan 900

monitor session 1 source remote vlan 900
monitor session 1 destination interface GigabitEthernet1/0/24

Points that come up in questions:

  • The remote-span keyword must be present on the VLAN on every switch in the path, including intermediate switches with no monitor session. It disables MAC address learning in that VLAN, so the copies are flooded along the trunks rather than learned against ports.
  • Session numbers are local to each switch. They do not have to match between source and destination.
  • The RSPAN VLAN must be allowed on every trunk in the path and must not carry user traffic.
  • RSPAN stays inside one Layer 2 domain. It cannot cross a router.

Exam trap

On the destination switch the RSPAN VLAN is a source (source remote vlan 900), not a destination. A configuration that uses destination remote vlan on both switches never delivers anything to the analyzer.

ERSPAN

Encapsulated RSPAN wraps each copied frame in a GRE header (with an ERSPAN header carrying a session ID) and routes it like any other IP packet. It is supported on IOS XE routers such as the Catalyst 8000 series and on Catalyst 9000 switches.

graph LR
  H1["Users"] -- "Gi2 source" --- R1["R1 origin 10.255.255.1"]
  R1 -- "routed WAN" --- R2["R2 10.255.255.2"]
  R2 -- "Gi3 destination" --- ANA["Analyzer"]
monitor session 10 type erspan-source
 description Copy user traffic to DC analyzer
 source interface GigabitEthernet2 both
 destination
  erspan-id 110
  ip address 10.255.255.2
  origin ip address 10.255.255.1
 no shutdown

monitor session 20 type erspan-destination
 destination interface GigabitEthernet3
 source
  erspan-id 110
  ip address 10.255.255.2
 no shutdown

monitor session 10 type erspan-source
 source interface GigabitEthernet2 both
 destination
  erspan-id 110
  ip address 192.168.100.60
  origin ip address 10.255.255.1
 no shutdown

How to read it:

Line Meaning
type erspan-source This session sends copies
destination / ip address Where the GRE packets are sent (the far device or a capture host)
origin ip address Source address of the GRE packets. Use a loopback.
erspan-id Session ID carried in the ERSPAN header; it must match the destination session
type erspan-destination / source / ip address The local address on which this device accepts the GRE packets
no shutdown ERSPAN sessions are created shut down; nothing is sent until you enable them

Wireshark decodes ERSPAN natively, so you can send ERSPAN straight to a capture host and skip the destination session entirely.

Exam trap

An ERSPAN session that looks perfect but sends nothing is usually still administratively shut down. show monitor session shows the state. The second most common cause is an erspan-id mismatch between source and destination.

Exam trap

ERSPAN adds roughly 50 bytes of outer headers (outer IP, GRE and ERSPAN). Full-size frames can exceed the MTU on the routed path. The copies may be fragmented or dropped, while production traffic is unaffected, so the analyzer shows gaps that do not exist in reality.

Verification

SW1# show monitor session 1
Session 1
---------
Type                     : Remote Source Session
Source Ports             :
    Both                 : Gi1/0/5
Dest RSPAN VLAN          : 900

SW3# show monitor session 1
Session 1
---------
Type                     : Remote Destination Session
Source RSPAN VLAN        : 900
Destination Ports        : Gi1/0/24
    Encapsulation        : Native
          Ingress        : Disabled

R1# show monitor session 10
Session 10
----------
Type                   : ERSPAN Source Session
Status                 : Admin Enabled
Source Ports           :
    Both               : Gi2
Destination IP Address : 10.255.255.2
Origin IP Address      : 10.255.255.1
ERSPAN ID              : 110

show monitor session all lists every session, and show monitor session 1 detail lists every field, including empty ones. On Catalyst switches, show interfaces Gi1/0/24 status shows the destination port as monitoring.

Embedded Packet Capture: the on-box option

When there is no analyzer port at all, IOS XE can capture packets itself and export them as a pcap file.

R1# monitor capture CAP interface GigabitEthernet2 both
R1# monitor capture CAP match ipv4 host 10.10.10.11 any
R1# monitor capture CAP buffer size 10
R1# monitor capture CAP start
! reproduce the problem
R1# monitor capture CAP stop
R1# show monitor capture CAP buffer brief
R1# monitor capture CAP export flash:cap1.pcap
R1# no monitor capture CAP

Copy the file off with SCP or TFTP and open it in Wireshark. EPC is not on the 4.3 blueprint line, but it is the practical answer when the question asks how to capture on a router with no SPAN destination.

Lab: SPAN on the access switch, ERSPAN across the routers

Topology: the course base topology. Host1 on ACC1 Gi0/1, a second Ubuntu "analyzer" on ACC1 Gi0/2 with Wireshark or tcpdump. R1 and R2 are Catalyst 8000v with loopbacks reachable via OSPF. An Ubuntu capture host at 192.168.100.60 is on R1 Gi1.

  1. On ACC1: monitor session 1 source interface GigabitEthernet0/1 both and monitor session 1 destination interface GigabitEthernet0/2.
  2. On the analyzer, run sudo tcpdump -ni ens2 (use your interface name). Ping from Host1 to its gateway and confirm both the requests and the replies appear.
  3. Change the source to rx only and confirm only the echo requests are captured.
  4. On R1, build the "Direct to a capture host" ERSPAN session with source interface set to the link toward DIST1, but leave out no shutdown. Check show monitor session 10. Then add no shutdown.
  5. On the capture host run sudo tcpdump -ni ens2 proto gre and then open the capture in Wireshark. Expand the ERSPAN header and find the session ID 110.
  6. Change the erspan-id on R1 to 111 and note that a capture host does not care, but an erspan-destination session on R2 with ID 110 would stop delivering. Build that R2 session to prove it.

IOSvL2 supports local SPAN; if your image rejects the RSPAN or ERSPAN commands, do those steps on the Catalyst 8000v routers or on real Catalyst 9000 hardware.

Expected verification:

R1# show monitor session 10 | include Status|ERSPAN ID
Status                 : Admin Enabled
ERSPAN ID              : 110

For the timed version with syslog and SNMPv3, do Sim 10.

Quick check

A switch in the middle of the RSPAN path has no monitor session. What must it have?

VLAN 900 defined with remote-span, and the VLAN allowed on both trunks that carry it.

Which ERSPAN parameter must match on the source and destination sessions?

The erspan-id (session ID). The destination session's ip address must also equal the address the source sends to.

Copies need to keep their 802.1Q tags so the analyzer can tell VLANs apart. What do you add to the local SPAN destination?

encapsulation replicate on the monitor session N destination interface line.

References

  • Catalyst 9000 Network Management Configuration Guide: "Configuring SPAN and RSPAN" and "Configuring ERSPAN" (search on cisco.com for your release)
  • IOS XE Embedded Packet Capture configuration guide (search "Embedded Packet Capture IOS XE" on cisco.com)
  • Cisco Live On-Demand Library: search "packet capture Catalyst 9000"
  • Related: diagram E41. SPAN, RSPAN and ERSPAN