CCIE Practical Studies: Security (CCIE Self-Study)

Switched Port Analyzer Overview

At some point, you will need to analyze the network traffic that is passing through ports or VLANs by using the Switched Port Analyzer (SPAN) to send a copy of the traffic to another port on the switch that has been connected to a SwitchProbe device or other Remote Monitoring (RMON) probe. SPAN works by mirroring received or sent (or both) traffic on a source port, or received traffic on one or more source ports or source VLANs, to a destination port for analysis. Only the traffic that enters or leaves source ports or traffic that enters source VLANs can be monitored by using SPAN.

Although SPAN does not affect the switching of network traffic on source ports or source VLANs, use care so that you do not oversubscribe ...