How to setup Switched Port Analyzer (SPAN) on Cisco switches
Updated
by
Bryan Jones
Scope
This document describes the process of creating what Cisco calls a monitor session on your network switch. Monitor sessions are used when it becomes necessary to capture network traffic sent to some other port on your switch. For example, if you wanted to capture all traffic being sent to a Telos xNode, this document will assist you in setting this up.
Description
You can analyze network traffic passing through a port by using SPAN (Switched Port Analyzer), sometimes called port mirroring. This allows you to copy traffic as it moves to one port and make a copy of it on another. You can then capture this traffic using a tool like WireShark.
We make some underlying assumptions that you have some familiarity with programs like PuTTY or other terminal programs, and that you have access to your Cisco switch using telnet, ssh, or serial.
Things that you will need for this include;
- A Cisco switch. We'll use a 2960 in this example.
- An available port for mirroring on the Cisco switch.
- A PC for configuration and capture.
- Capture software like Wireshark mentioned above.
Configuration
- Connect to your Cisco switch. After logging in, enter the privileged EXEC mode using the 'enable' command and password. The # sign at the prompt indicates you are in privileged mode.
Livewire, livewire, Axia, or axia.
- From the prompt, enter the configure terminal mode.
Switch_2960# configure terminal
The prompt will change to include (config) indicating you are in configuration mode. From here, we need to enter the port used for our source, and the destination port where we will send the traffic.
We will be using Fast Ethernet 1 for our source and Fast Ethernet 8 for the destination.
Switch_2960 (config)# monitor session 1 source interface Fa0/1
Switch_2960 (config)# monitor session 1 destination interface Fa0/8
You are now mirroring ports 1 and 8 on your switch. Data sent to port 1 is duplicated to port 8.
- Start your Wireshark or other capture software.
- Select the Network interface used for this capture.
- Start your capture.
When your capture is complete, return to your Putty connection and turn off the monitor port. To do this;
Switch_2960 (config)# no monitor session 1
General comments about this procedure
You may need two network cards or two computers for this process. Once you configure a port as a SPAN, you will lose access to it for configuration purposes.
Secondly, if this port has multicast audio on it, the captures will be quite large. You should not leave this running for long periods. Running a capture for only one or two minutes will produce huge files.
Also, be aware that the creation of a mirror port will require some amount of CPU from your Cisco switch and could adversely affect your network, so plan accordingly. Most of the time, there are no issues, but it's best to plan ahead.
Let us know how we can help
If you have further questions on this topic or have ideas about improving this document please contact us
