To start a new Encapulated RSPAN (ERSPAN), Switched Port Analyzer (SPAN), or remote SPAN (RSPAN) session; add interfaces
or VLANs to an existing session; filter ERSPAN, SPAN, or RSPAN traffic to specific VLANs; use the
monitorsession command in global configuration mode. To remove one or more source or destination interfaces from the session, remove a source
VLAN from the session, remove filtering, or delete a session, use the
no form of this command.
Setting the Source Interface or VLAN
monitor session session source {interface type | vlan vlan-id}remote vlan rspan-vlan-id(explicit id )
nomonitor session session source {interface type | vlan vlan-id}remote vlan rspan-vlan-id
Setting the Destination Interface or VLAN
monitor session session destination {interface type | vlan vlan-id | remote vlan vlan-id | analysis-module slot-number | data-port port-number}
no monitor session session destination {interface type | vlan vlan-id | remote vlan vlan-id | analysis-module slot-number | data-port port-number}
Setting the Filter VLAN
monitor session session filter vlan vlan-range
no monitor session session filter vlan vlan-range
Removing Session
no monitor session {session | all | capture | local | range session-range | remote}
Syntax Description
|
session
|
Number of the SPAN session. For Cisco 6500/6000 and Cisco 7600 series routers, valid values are 1 to 66.
|
|
source
|
Specifies the SPAN source.
|
|
destination
|
Specifies the SPAN destination.
|
|
interface
type
|
Specifies the interface type. For the Cisco 6500/6000 and Cisco 7600 series routers, valid values are
ethernet ,
fastethernet ,
gigabitethernet ,
port-channel , or
tengigabitethernet ; see the “Usage Guidelines” for formatting information.
|
|
vlan
vlan
id
|
Specifies the VLAN ID. Beginning with Cisco IOS Release 12.4(15)T, the valid VLAN ID range is from 1 to 4094.
For the Cisco 6500/6000 and Cisco 7600 series routers, valid values are 1 to 4094.
|
|
,
|
(Optional) Specifies a series of SPAN VLANs.
|
|
-
|
(Optional) Specifies a range of SPAN VLANs.
|
|
rx
|
(Optional) Specifies monitor received traffic only.
|
|
tx
|
(Optional) Specifies monitor transmitted traffic only.
|
|
both
|
(Optional) Specifies monitor received and transmitted traffic. By default both received and transmitted traffic are monitored.
|
|
remote
vlan
rspan-vlan-id
|
Specifies the RSPAN VLAN as a destination VLAN.
|
|
analysis-module
slot-number
|
Specifies the network analysis module number; see the “Usage Guidelines” section for additional information.
|
|
data-port
port-number
|
Specifies the data port number; see the “Usage Guidelines” section for additional information.
|
|
filter
vlan
vlan-range
|
Limits SPAN-source traffic to specific VLANs.
| Note
|
The
filter keyword is not supported on the Cisco 2600 series or the Cisco 3600 series routers.
|
|
|
all
|
Specifies all sessions.
|
|
capture
|
Specifies the Capture session.
|
|
local
|
Specifies the local session.
|
|
range
session-range
|
Specifies the range of sessions.
|
|
remote
|
Specifies the remote session.
|
Command Default
Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series Routers
A trunking interface monitors all VLANs and all received and transmitted traffic.
Command Modes
Global configuration (config)
Command History
|
Release
|
Modification
|
|
12.0(7)XE
|
This command was introduced on the Catalyst 6000 family switches.
|
|
12.1(1)E
|
Support for this command on the Catalyst 6000 family switches was extended to Cisco IOS Release 12.1(1)E.
|
|
12.1(3a)E3
|
This command was modified. The number of valid values for the port-channel number was changed; see the “Usage Guidelines”
section for valid values.
|
|
12.1(5c)EX
|
This command was modified. The SPAN support restrictions were added:
-
If your switch has a Switch Fabric Module installed, SPAN is supported among supervisor engines and nonfabric-enabled modules.
-
If your switch does not have a Switch Fabric Module installed, SPAN is supported on all modules, including fabric-enabled
modules.
-
SPAN on Distributed Forwarding Card (DFC) equipped modules is not supported.
|
|
12.2(17a)SX
|
Support for this command was introduced on the Supervisor Engine 720.
|
|
12.2(17d)SXA
|
This command was modified. This command was changed to support the SSO mode and change the default mode.
|
|
12.2(17d)SXB
|
This command was introduced on the Supervisor Engine 2.
|
|
12.2(18)SXE
|
This command was modified. The following changes were made to this command on the Supervisor Engine 720:
-
Added the
typeerspan-source and the
typeerspan-source keywords to support ERSPAN; see the
monitorsessiontype command for additional information.
-
In the transmit or transmit and receive directions, you can specify up to 128 physical interfaces as the source.
|
|
12.4(15)T
|
This command was modified. The range of valid VLAN IDs was extended.The new range is from 1 to 4094 for specified platforms.
|
Usage Guidelines
Ciso 6500/6000 Catalyst Switches
The number of valid values for
port-channel number depends on the software release. For Cisco IOS releases prior to software Release 12.1(3a)E3, valid values are from 1 to
256; for Cisco IOS Release 12.1(3a)E3, 12.1(3a)E4, and 12.1(4)E1, valid values are from 1 to 64. Cisco IOS Release 12.1(5c)EX
and later support a maximum of 64 values ranging from 1 to 256.
Only one destination per SPAN session is supported. If you attempt to add another destination interface to a session that
already has a destination interface configured, you get an error. You must first remove a SPAN destination interface before
changing the SPAN destination to a different interface.
You can configure up to 64 SPAN destination interfaces, but have only one egress SPAN source interface and only up to 64
ingress source interfaces.
A SPAN session can monitor either VLANs or individual interfaces, but it cannot monitor both specific interfaces and specific
VLANs. Configuring a SPAN session with a source interface and then trying to add a source VLAN to the same SPAN session causes
an error. Configuring a SPAN session with a source VLAN and then trying to add a source interface to that session also causes
an error. You must first clear any sources for a SPAN session before switching to another type of source.
If you enter the
filter keyword on a monitored trunk interface, only traffic on the set of specified VLANs is monitored.
Port channel interfaces are displayed in the list of
interface options if you have configured the interfaces. VLAN interfaces are not supported. However, you can span a particular VLAN
by entering the
monitorsession session source vlan vlan id command.
Cisco 7600 Series Routers
Use these formatting guidelines when configuring monitor sessions:
-
interface
and
single-interface formats are
typeslot / port ; valid values for
type are
ethernet ,
fastethernet ,
gigabitethernet , or
tengigabitethernet
-
An
interface-list is a list of interfaces that are separated by commas. Insert a space before and after each comma as shown in this example:
single-interface
,
single-interface ,
single-interface
type
slot
/
first-port
,
last-port
single-interface
,
- interface-range , ... in any order.
single-vlan, single-vlan, single-vlan ...
first-vlan-ID
-
last-vlan-ID
single-vlan
,
vlan-range , ... in any order
The
analysis-module slot-number and the
data-port port-number keywords and arguments are supported only on NAM.
The number of valid values for
port-channel number are a maximum of 64 values ranging from 1 to 256.
You cannot share the destination interfaces among SPAN sessions. For example, a single destination interface can belong to
one SPAN session only and cannot be configured as a destination interface in another SPAN session.
Note |
Be careful when configuring SPAN-type source ports that are associated to SPAN-type destination ports because you do not
configure SPAN on high-traffic interfaces. If you configure SPAN on high-traffic interfaces, you may saturate fabric channels,
replication engines, and interfaces. To configure SPAN-type source ports that are associated to SPAN-type destination ports,
enter the
monitorsession session source {interface type |
vlan vlan-id rx |
tx |
both ] |
remotevlan rspan-vlan-id } command.
|
The Supervisor Engine 720 local SPAN, RSPAN, and ERSPAN session limits are listed in the table below.
Table 6. Supervisor Engine 720 Local SPAN, RSPAN, and ERSPAN Session Limits
|
Total Sessions
|
Local SPAN, RSPAN Source, or ERSPAN Source Sessions
|
RSPAN Destination Sessions
|
ERSPAN Destination Sessions
|
|
66
|
2 (ingress or egress or both)
|
64
|
23
|
The Supervisor Engine 720 local SPAN, RSPAN, and ERSPAN source and destination limits are listed in the table below.
Table 7. Supervisor Engine 720 Local SPAN, RSPAN, and ERSPAN Source and Destination Limits
|
|
In Each Local SPAN Session
|
In Each RSPAN Source Session
|
In Each ERSPAN Source Session
|
In Each RSPAN Destination Session
|
In Each ERSPAN Destination Session
|
|
Egress or ingress and egress sources
|
--
|
--
|
|
Releases earlier than Release 12.2(18)SXE
|
1
|
1
|
1
|
|
Release 12.2(18)SXE and later releases
|
128
|
128
|
128
|
|
Ingress sources
|
--
|
--
|
|
Releases earlier than Release 12.2(18)SXD
|
64
|
64
|
64
|
|
Release 12.2(18)SXD and later releases
|
128
|
128
|
128
|
|
RSPAN and ERSPAN destination session sources
|
--
|
--
|
--
|
1 RSPAN VLAN
|
1 IP address
|
|
Destinations per session
|
64
|
1 RSPAN VLAN
|
1 IP address
|
64
|
64
|
Note |
Supervisor Engine 2 does not support RSPAN if you configure an egress SPAN source for a local SPAN session.
|
The Supervisor Engine 2 local SPAN and RSPAN session limits are listed in the table below.
Table 8. Supervisor Engine 2 Local SPAN and RSPAN Session Limits
|
Total Sessions
|
Local SPAN Sessions
|
RSPAN Source Sessions
|
RSPAN Destination Sessions
|
|
66
|
2 (ingress or egress or both)
|
0
|
64
|
|
1 ingress
|
1 (ingress or egress or both)
|
64
|
|
1 or 2 egress
|
0
|
64
|
The Supervisor Engine 2 local SPAN and RSPAN source and destination limits are listed in the table below.
Table 9. Supervisor Engine 2 Local SPAN and RSPAN Source and Destination Limits
|
|
In Each Local SPAN Session
|
In Each RSPAN Source Session
|
In Each RSPAN Destination Session
|
|
Egress or egress and ingress sources
|
1 (0 with a remote SPAN source session configured)
|
1 (0 with a local SPAN egress source session configured)
|
--
|
|
Ingress sources
|
--
|
|
With releases earlier than Release 12.2(18)SXD
|
64
|
64
|
|
Release 12.2(18)SXD and later releases
|
128
|
128
|
|
RSPAN destination session source
|
--
|
--
|
1 RSPAN VLAN
|
|
Destinations per session
|
64
|
1 RSPAN VLAN
|
64
|
Note |
Supervisor Engine 2 does not support RSPAN if you configure an egress SPAN source for a local SPAN session.
|
A particular SPAN session can monitor either VLANs or individual interfaces; you cannot have a SPAN session that monitors
both specific interfaces and specific VLANs. If you first configure a SPAN session with a source interface and then try to
add a source VLAN to the same SPAN session, you will get an error. You will also get an error if you configure a SPAN session
with a source VLAN and then try to add a source interface to that session. You must first clear any sources for a SPAN session
before switching to another type of source.
If you enter the
filter keyword on a monitored trunk interface, only traffic on the set of specified VLANs is monitored.
The port-channel interfaces are displayed in the list of
interface options if you have configured the interfaces. The VLAN interfaces are not supported. However, you can span a particular
VLAN by entering the
monitorsession session source vlan vlan-id command.
The
showmonitor command displays the SPAN service module session only if it is allocated in the system. It also displays a list of allowed
modules and a list of active modules that can use the service module session.
Examples
The following example shows how to add a destination VLAN to an existing SPAN session:
Router(config)# monitor session 1 destination vlan 100
The following example shows how to delete a destination VLAN from an existing SPAN session:
Router(config)# no monitor session 1 destination vlan 100
The following example shows how to limit SPAN traffic to specific VLANs:
Router(config)# monitor session 1 filter vlan 100 - 304
Examples
This example shows how to configure multiple sources for a session:
Router(config)# monitor session 2 source interface fastethernet 5/15 , 7/3 rx
Router(config)# monitor session 2 source interface gigabitethernet 1/2 tx
Router(config)# monitor session 2 source interface port-channel 102
Router(config)# monitor session 2 source filter vlan 2 - 3
Router(config)# monitor session 2 destination remote vlan 901
This example shows how to configure an RSPAN destination in the final switch (RSPAN destination session):
Router(config)# monitor session 8 source remote vlan 901
Router(config)# monitor session 8 destination interface fastethernet 1/2 , 2/3
This example shows how to clear the configuration for sessions 1 and 2:
Router(config)# no monitor session 1 - 2
This example shows how to clear the configuration for all sessions:
Router(config)# no monitor session all
This example shows how to clear the configuration for all remote sessions:
Router(config)# no monitor session remote
Feedback