How to setup Switched Port Analyzer (SPAN) on Cisco switches

Updated by Bryan Jones

Scope

This document describes the process of creating what Cisco calls a monitor session on your network switch. Monitor sessions are used when it becomes necessary to capture network traffic sent to some other port on your switch. For example, if you wanted to capture all traffic being sent to a Telos xNode, this document will assist you in setting this up.

Description

You can analyze network traffic passing through a port by using SPAN (Switched Port Analyzer), sometimes called port mirroring. This allows you to copy traffic as it moves to one port and make a copy of it on another. You can then capture this traffic using a tool like WireShark.

Wireshark is a free and open-source packet analyzer. Wireshark is used for network troubleshooting and analysis. Visit their website HERE.

We make some underlying assumptions that you have some familiarity with programs like PuTTY or other terminal programs, and that you have access to your Cisco switch using telnet, ssh, or serial.

Things that you will need for this include;

  • A Cisco switch. We'll use a 2960 in this example.
  • An available port for mirroring on the Cisco switch.
  • A PC for configuration and capture.
  • Capture software like Wireshark mentioned above.

Configuration

  1. Connect to your Cisco switch. After logging in, enter the privileged EXEC mode using the 'enable' command and password. The # sign at the prompt indicates you are in privileged mode.
If Telos assisted with the setup of this switch, the passwords uses are either;
Livewire, livewire, Axia, or axia.
  1. From the prompt, enter the configure terminal mode.
Switch_2960# configure terminal

The prompt will change to include (config) indicating you are in configuration mode. From here, we need to enter the port used for our source, and the destination port where we will send the traffic.

We will be using Fast Ethernet 1 for our source and Fast Ethernet 8 for the destination.

Switch_2960 (config)# monitor session 1 source interface Fa0/1
Switch_2960 (config)# monitor session 1 destination interface Fa0/8

You are now mirroring ports 1 and 8 on your switch. Data sent to port 1 is duplicated to port 8.

  1. Start your Wireshark or other capture software.
  2. Select the Network interface used for this capture.
  3. Start your capture.

When your capture is complete, return to your Putty connection and turn off the monitor port. To do this;

Switch_2960 (config)# no monitor session 1

General comments about this procedure

You may need two network cards or two computers for this process. Once you configure a port as a SPAN, you will lose access to it for configuration purposes.

Secondly, if this port has multicast audio on it, the captures will be quite large. You should not leave this running for long periods. Running a capture for only one or two minutes will produce huge files.

Also, be aware that the creation of a mirror port will require some amount of CPU from your Cisco switch and could adversely affect your network, so plan accordingly. Most of the time, there are no issues, but it's best to plan ahead.

Let us know how we can help

If you have further questions on this topic or have ideas about improving this document please contact us


How did we do?