So that was an example of basic span, there are multiple options when you configure span, so let's remove
our current session
`and then specify monitor session. Let's create a new one of one source port is going to be interface
FastEthernet
103 in this example, and I'm only going to do receiving of traffic.
One intersession destination,
interface 105
rather 105 and hit enter.
Now I purposely are only creating one session with the same number to keep it simple, but be aware
that you can create multiple span sessions.
There are some dependencies and rules with regards to span, a span destination port can only be used with
one span session at a time.
A span destination port can also not be a span source port.
When you create a span destination port
the switch no longer treats that port as a standard Ethernet port.
As I demonstrated, Mac addresses are not learned on that port and traffic received on that port is
not accepted by default.
You can remove a span destination port by using the no monitor session and a number and the destination
interface and then add it to a different monetization.
So in other words, you can move it from one session to another.
Multiple span sources can be used within a single-span session.
One span session cannot mix interfaces and VLAN sources, so you must either look at multiple interfaces
or multiple VLANs.
One span session can use any combination of directions.
So transmit, receive or both.
Ether channel can be used as a source port in port monitoring or span.
Trunks can also be used as source ports if required.
So in this example, we've only got a single interface, but we could change that to FastEthernet
103 and then specify a range of interfaces if required.
So let's say 101
and typical Cisco fashion, the command is different here to other commands.
So I'll do receive on both those interfaces, so do show run pipe include monitor or in our example
span ports, we're going to look at traffic received on 101 as well as 103.
So I'll restart the Wireshark capture.
On router 1, I'm going to send a single ping to router 2 what you'll notice, even though we're only
looking at receiving of traffic, we captured both ping, echo as well as echo reply.
So the echo would have been received on this port when router 1 transmitted traffic to router 2 and
the echo reply would have been received on this port.
So hence we received both the echo and echo reply.
If we had only configured this port, we would only have received the echo and not the echo reply.
So let's do that.
So no monitor session 1,
we're only going to capture the traffic received on this port and then we'll send it out of port 10
5.
So now when I clear the session
and do a ping.
Notice we only receive half the traffic.
So be careful which ports are the source of your capture and be careful of the direction of traffic,
both will allow you to capture traffic in and out of that port,
receive is only traffic received on that port, transmit is traffic sent out of that port.
You could, as an example, capture on the VLAN, so let's get rid of session 1
and what I'll do is say VLAN 1
received traffic
and the destination will be port 5,
I'll clear the Wireshark capture
and do a single ping again and notice here we see both the echo and echo reply message, so there's
echo reply,
here's echo request
because this port and this port on VLAN 1, this port 102 is actually shut down in this
topology.
So we could delete that port from the topology.
So show commands again, show the monitor.
We can see that we've got one session enabled.
It's a local session.
We were receiving traffic on VLAN 1 destination port is 105.
We're using a native encapsulation and ingress is disabled,
so traffic will be dropped
that's received on this port.
We can also look at detailed information.
So it's a local session.
There are no source ports configured.
We only have a source VLAN configured
and we're capturing traffic received on VLAN 1 not transmitted on VLAN 1 a remote span session
is not configured,
the destination port for the span session is 105,
other options are not configured.
So let's have a look at some of the options, show, monitor session
all at the moment, no span configuration is present on the system, we can look at local span, we
can even look at remote span, remote span is used where you have a different source and destination switch.
So the source port could be this port on switch 2 and the destination could be this port on switch
1.
So traffic will be captured on this port and sent to the capturing device on this switch,
switch 1.
So I'll configure a monitor session, so monitor session, pick a number like 1, source interface Fast
Ethernet 101.
The destination in our example is going to be 105.
So do show run, pipe include monitor.
That's what we've done if we try to configure another session using the same destination port of interface,
f105 notice, we're told that, that port is already being used, so we configured this port
as the destination of session 1, we can't now configure it to be the destination for session 2
but we could, as an example, configure session 2 and specify a different source.
So 1
01 as an example, so do show run, pipe include monitor.
We've got two sources configured, but only one destination, so show
monitor session all.
We've got session 1 configured and session 2 configured, but only session 1 is configured with
the destination
port session 2 is not currently being used.
On our Wireshark device, we should be able to capture traffic from router 1 to router 2 which we can.
So unicast traffic sent from router 1 to router 2 is being forwarded out of this port
because of this monitoring session.
Traffic sent and received on F1/1 is going to be sent out of 105
and hence, we see the ICMP echo request and echo reply messages.
Now, there's nothing stopping us moving the destination port from one session to another, so we could
put a no in front of that command.
We'll now move it to session 2, so that's accepted.
So what we've done now is move the destination port from session 1 to session 2.
I'll clear that Wireshark capture do the ping again
and notice we're capturing the traffic because we are capturing similar kind of traffic, but in a different
session.