Mastering The Art Of SPAN Port Mirroring: A Practical Approach
A switch port analyzer or SPAN port mirroring is a way through which we capture network data for monitoring purposes. It is also called port mirroring because it mirrors traffic from different ports to different ports. We mirror the network traffic from one set of ports to another port which can then be connected to a monitoring device. It allows us to analyze the network traffic through some software like Wireshark to monitor client usage and perform general analysis.
SPAN Port Mirroring Variations
a) Local SPAN
In the local Switch port analyzer, traffic is captured locally on a switch and mirrored to another local port on the same device.
Suppose a network administrator wants to capture port 10 traffic, and he also wants to analyze port 10 traffic at the local port 1.
b) Remote SPAN Port Mirroring
In this scenario, you can monitor your network traffic from remote locations that are distributed over multiple switches throughout the network.
Suppose you want to monitor the traffic of port 20,21,22 on switch2 and analyze it at switch2 on port 5. The source ports are at switch2 while the destination ports are at switch1. When the traffic passes between switches, then it will use a special vlan tag which is called Remote SPAN vlan. It is specially designed only for RSPAN traffic. The link between the two switches must be of the trunk.
c) ERSPAN
It is a Cisco proprietary, which uses a GRE tunnel to send traffic to a central location. It sends traffic through the layer 3 routing network. Every Cisco switch doesn’t support ERSPAN. But, it is supported by high-end Cisco switches like 4500, 6500 series, and Nexus switches.
Configure a separate vlan for RSPAN, and don’t assign access ports to the Remote port analyzer. Similarly, Remote-span vlan must be allowed on a trunk port. Moreover, If VTP is configured in the network and VTP pruning is enabled on it, then it must be disabled for Remote SPAN vlan.
Important Points
The interfaces that we monitor are called source ports, or monitor ports, While those interfaces from where we monitor the traffic are called destination ports. The monitor ports will either transmit the traffic (Tx) receive the traffic or it will do both. Source and destination ports cannot be the same port. The destination port shouldn’t be fully saturated. It must be of greater bandwidth.
1) Configuration of Local SPAN
Below is the lap topology of Local SPAN Port Mirroring, which we will use for its implementation. There are three PCs and one server connected with Switch. A sniffer is also connected with a switch through the Gig 0/1 interface.
Interface fast ethernet from 0/1 to 0/5 will be monitored both for traffic receiving and transmitting. The sniffer through Gig 0/1 will monitor all five interfaces.
Check the monitor session at the switch by the following command.
Ping each PC from one another. Also, browse the web server by writing its IP address 192.168.1.1 in the browser for generating HTTP traffic as below:
Now check the traffic generated in the network in the sniffer.
That was the Local switch port mirroring configuration. The next configuration is RSPAN.
2) Configuration of RSPAN
Below is the lab topology of Remote port mirroring. There are two switches in the network. Two PCs are connected to the Switch1 and a server is also connected to it. A sniffer is connected to the switch 2. We will analyze the traffic at switch2 through Sniffer. The two switches are connected through a trunk link.
We will analyze the traffic of the web server that is connected to the switch via Fa 0/1. An analyzer at switch 2 is connected via Gig 0/1. There is a trunk link between two switches. Below is the configuration of RSPAN at switch1.
Configuration of RSPAN at switch2
Show monitor session at Switch1
Also, check the session at Swtich2
Check sniffer at switch2
Generate some traffic by Ping we server from PC at switch1. Also, browse the web server in PC1 by writing its IP address in the web browser of the PC.
Now check the Sniffer the sniffer to monitor the traffic.
ICMP means that we Ping the web server, while HTTP indicates web browsing.
3) Configuration of ERSPAN
Below is the lab topology of ERSPAN.
The source port is in one network, while the destination port (analyzer) is in another network. So we will analyze the traffic of Network1 from Network3.
Configuration of Router R1.
Similarly, the configuration of ERSPAN on Router R2.
