SPAN and VSPAN demonstration


VSPAN: Source Vlan 1, destination fa0/22.

monitor session 1 source vlan 1 rx
monitor session 1 destination interface Fa0/22

Cat3550 has its limitation of only monitoring traffic received by Vlan. The destination port is at fa0/22. I connected my pc to fa0/22 and turned on wireshark, meanwhile my pc at fa0/21 is pinging to Vlan 1 ip address From the wireshark output Vlan 1 is receiving icmp echo request from (which is the ip address of the pc at port fa0/21).


monitor session 1 source interface Fa0/21 both
monitor session 1 destination interface Fa0/22

SPAN: Source fa0/21, traffic direction is both. Destination is fa0/22

The default behaviour of SPAN is both direction, if not specified. As you can see whatever is received from fa0/21 and sent to fa0/21 is seen on fa0/22.

Port that is configured as destination port will be removed from vlan list:

Switch#sh vlan brief

VLAN Name                             Status    Ports
—- ——————————– ——— ——————————-
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/11, Fa0/12
Fa0/13, Fa0/14, Fa0/15, Fa0/16
Fa0/17, Fa0/18, Fa0/19, Fa0/20
Fa0/21, Fa0/23, Fa0/24, Gi0/1
10   Production                       active
20   Guest                            active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

As you can see fa0/22 is not in vlan 1.

You do not need to assign a static ip address to the wireshark enabled computer at all, all you need to do is to turn on wireshark and connect an ethernet cable to port fa0/22 or other destination port you have configured and see the duplicated copies of data from your source port or source vlan.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s