Configuring SPAN and RSPAN

You can analyze network traffic passing through ports or VLANs by using SPAN to send a copy of the traffic to another port on the switch that has been connected to a SwitchProbe device or other Remote Monitoring (RMON) probe or security device. SPAN mirrors received or transmitted (or both) traffic on a source port and received traffic on one or more source ports or source VLANs, to a destination port for analysis. 

Creating a SPAN Session and Specifying Ports to Monitor

This example shows how to set up a SPAN session, session 1, for monitoring source port traffic to a destination port. First, any existing SPAN configuration for session 1 is cleared, and then bidirectional traffic is mirrored from source port 1 to destination port 10.

Switch(config)# no monitor session 1

Switch(config)# monitor session 1 source interface fastEthernet0/1

Switch(config)# monitor session 1 destination interface fastEthernet0/10 
encapsulation dot1q

Switch(config)# end 

Configuring RSPAN 

Creating an RSPAN Session 

This example shows how to clear any existing RSPAN configuration for session 1, configure RSPAN session 1 to monitor multiple source interfaces, and configure the destination RSPAN VLAN and the reflector-port.

Switch(config)# no monitor session 1

Switch(config)# monitor session 1 source interface fastEthernet0/10 tx

Switch(config)# monitor session 1 source interface fastEthernet0/2 rx

Switch(config)# monitor session 1 source interface fastEthernet0/3 rx

Switch(config)# monitor session 1 source interface port-channel 102 rx

Switch(config)# monitor session 1 destination remote vlan 901 reflector-port 
fastEthernet0/1

Switch(config)# end

 

Creating an RSPAN Destination Session 

This example shows how to configure VLAN 901 as the source remote VLAN and port 5 as the destination interface:

Switch(config)# monitor session 1 source remote vlan 901

Switch(config)# monitor session 1 destination interface fastEthernet0/5

Switch(config)# end

 

Creating an RSPAN Destination Session and Enabling Ingress Traffic 

This example shows how to configure VLAN 901 as the source remote VLAN and how to configure the destination port for ingress traffic on VLAN 5 by using a security device that supports 802.1Q encapsulation:

Switch(config)# monitor session 1 source remote vlan 901

Switch(config)# monitor session 1 destination interface fastEthernet0/5 ingress vlan 5

Switch(config)# end

 

Ref: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/swspan.html#wp1036816