4.3 Configure SPAN/RSPAN/ERSPAN

Sometimes counters and logs are not enough. You need to see the packets.

SPAN, RSPAN, and ERSPAN copy traffic from one place to another so a packet analyzer can inspect it. The exam wants you to know the differences and configure the basic forms.

The short version

SPAN · local copy Gi1/0/1 → Gi1/0/48
RSPAN · remote-span VLAN 999 across trunk
ERSPAN · GRE tunnel to remote collector

SPAN: local mirroring

Local SPAN is the simplest case.

conf t
monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/48 encapsulation replicate
 end

In this example:

• Gi1/0/1 is the source port.
• both mirrors ingress and egress traffic.
• Gi1/0/48 is the analyzer port.
• encapsulation replicate preserves original encapsulation when supported.

Verify:

show monitor session 1

A destination SPAN port is not a normal access port while it is a monitor destination. Do not connect an end user there and expect normal switchport behavior.

SPAN source options

A SPAN source can often be an interface, VLAN, or port-channel depending on platform support.

monitor session 1 source vlan 10 rx
monitor session 1 source interface Port-channel1 tx

Direction matters:

• rx mirrors received traffic.
• tx mirrors transmitted traffic.
• both mirrors both directions.

Use the narrowest source that captures the traffic you need. Mirroring too much traffic can oversubscribe the destination port and produce a misleading capture.

A configured SPAN session proves only that the switch is attempting to copy traffic. It does not prove the analyzer received every packet. If the destination port, analyzer NIC, or capture host cannot keep up, the capture can drop traffic while the production flow continues normally.

Teach SPAN like a packet walk:

1. Identify the production interface or VLAN where the packet should appear.
2. Pick rx, tx, or both based on that packet direction at that point in the network.
3. Confirm the destination port is not expected to forward normal user traffic.
4. Confirm the capture host can receive at the mirrored rate.
5. Treat absence from the capture as evidence, not proof, until the mirror path is verified.

RSPAN: remote mirroring over Layer 2

RSPAN carries mirrored traffic across a special VLAN. The source switch places mirrored frames into the remote-span VLAN, trunks carry it, and the destination switch sends that traffic to the analyzer.

Source switch

conf t
vlan 999
 name RSPAN-CAPTURE
 remote-span
!
monitor session 2 source interface GigabitEthernet1/0/1 both
monitor session 2 destination remote vlan 999
 end

Trunks between switches

Make sure VLAN 999 exists and is allowed across the trunk path.

RSPAN is especially easy to misread: the remote-span VLAN is a transport for copied frames, not a user VLAN where normal endpoints should live. If the VLAN is pruned, blocked, or missing on the path, the capture fails even though the production traffic may still be fine.

interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan add 999

Destination switch

conf t
vlan 999
 name RSPAN-CAPTURE
 remote-span
!
monitor session 2 source remote vlan 999
monitor session 2 destination interface GigabitEthernet1/0/48
 end

Verify on both switches:

show vlan remote-span
show monitor session 2
show interfaces trunk

RSPAN is Layer 2. If the source and analyzer are not in the same bridged/trunked domain, use ERSPAN instead.

For RSPAN to work, the remote-span VLAN must exist as a remote-span VLAN on the participating switches, be allowed across the trunk path, and be kept out of normal access-port use. Treat it as capture transport, not a user VLAN.

ERSPAN: remote mirroring over IP

ERSPAN uses GRE encapsulation to carry mirrored traffic over a Layer 3 network. Syntax varies by platform, but the concept is consistent: define an ERSPAN source session and send the mirrored traffic to a remote IP address.

ERSPAN source

conf t
monitor session 3 type erspan-source
 source interface GigabitEthernet1/0/1 both
 destination
 erspan-id 30
 ip address 10.20.20.20
 origin ip address 10.20.20.10
 end

ERSPAN destination

conf t
monitor session 3 type erspan-destination
 destination interface GigabitEthernet1/0/48
 source
 erspan-id 30
 ip address 10.20.20.10
 end

Think of ERSPAN as “SPAN over routed IP.” The analyzer side receives decapsulated mirrored traffic.

ERSPAN also needs the transport path to allow the encapsulated traffic. Verify routed reachability, any ACL or firewall treatment of GRE/ERSPAN traffic, MTU overhead, and matching ERSPAN IDs between source and destination.

Common mistakes

Destination port is too slow

If you mirror two 1 Gbps directions into one 1 Gbps analyzer port, the capture can drop packets. SPAN is a copy, not magic bandwidth.

Mirroring the wrong direction

If you only mirror rx, you may miss return traffic.

RSPAN VLAN not allowed on trunks

The RSPAN configuration can be correct on each switch but fail because the remote-span VLAN does not cross the trunk path.

ERSPAN reachability missing

ERSPAN needs routed reachability between source and destination IPs. Check routing before blaming SPAN.

Lab: Build all three mirror types

Topology

PC1 -> SW1 -> SW2 -> Analyzer | | R1 -> R2

Part 1: Local SPAN on SW1

Mirror PC1 traffic to a local analyzer on Gi1/0/48.

SW1(config)# monitor session 1 source interface Gi1/0/1 both
SW1(config)# monitor session 1 destination interface Gi1/0/48 encapsulation replicate
SW1# show monitor session 1

Expected result: the analyzer connected to Gi1/0/48 sees PC1 packets.

Part 2: RSPAN from SW1 to SW2

Create VLAN 999 as a remote-span VLAN on both switches and allow it on the trunk.

SW1(config)# vlan 999
SW1(config-vlan)# remote-span
SW1(config)# monitor session 2 source interface Gi1/0/1 both
SW1(config)# monitor session 2 destination remote vlan 999
SW2(config)# vlan 999
SW2(config-vlan)# remote-span
SW2(config)# monitor session 2 source remote vlan 999
SW2(config)# monitor session 2 destination interface Gi1/0/48

Verify:

show vlan remote-span
show interfaces trunk
show monitor session 2

Expected result: the analyzer on SW2 sees mirrored PC1 packets.

Part 3: ERSPAN between routed switches

Use ERSPAN when SW1 and SW2 are separated by Layer 3.

SW1(config)# monitor session 3 type erspan-source
SW1(config-mon-erspan-src)# source interface Gi1/0/1 both
SW1(config-mon-erspan-src)# destination
SW1(config-mon-erspan-src-dst)# erspan-id 30
SW1(config-mon-erspan-src-dst)# ip address 10.20.20.20
SW1(config-mon-erspan-src-dst)# origin ip address 10.20.20.10

Verify routing and session state:

show ip route 10.20.20.20
show monitor session 3

Exam takeaways

• SPAN is local.
• RSPAN uses a remote-span VLAN across Layer 2 trunks.
• ERSPAN uses IP/GRE to cross Layer 3.
• Destination ports can drop mirrored packets if oversubscribed.
• Always verify the monitor session and the transport path.