So that was an example of basic span.
There are multiple options when you can figure span.
So let's remove our current session and then specify monitor session.
Let's create a new one of one source port is going to be interface first Ethernet to 1 0 3.
In this example and I'm only going to do receiving of traffic monitor session destination
interface 1 0 5
rather 1 0 5 and hit enter.
Now I purposely are only creating one session with the same number to keep it simple but be aware that
you can create multiple span sessions.
There are some dependencies and rules with regards to span a span destination port can only be used
with one span session at a time a span destination port can also not be a span source port.
When you create a span destination port the switch no longer treats that port as a standard Ethan at
port.
As I demonstrated MAC addresses are not learned on that port and traffic received on that port is not
accepted by default.
You can remove a spam destination port by using the no monitor session and a number and the destination
interface and then add it to a different monitor session.
So in other words you can move it from one session to another multiple spans sources can be used within
a single span session one span session cannot mix interfaces and VLAN sources so you must either look
at multiple interfaces or multiple villains one span session can use any combination of directions so
transmit receive or both ether channel can be used as a source port in Port monitoring or span trunks
can also be used as source ports if required.
So in this example we've only got a single interface but we could change that to foster Ethernet.
1 0 3 and then specify a range of interfaces if required.
So let's say 1 0 1 and typical Cisco fashion.
The command is different here to other commands so I'll do receive on both those interfaces so do show
run pipe include monitor or in our example span ports.
We're going to look at traffic received on 1 0 1 as well as 1 0 3 so I'll restart the Y shall capture
on Route 1 I'm going to send a single ping to write it to what you'll notice even though we only looking
at receiving of traffic we captured both ping Echo as well as Echo reply so the echo would have been
received on this port when Rata 1 transmitted traffic to write at 2 and the Echo reply would have been
received on this port so hence we received both the echo and echo reply if we had only configured this
port we would only have received the echo and not the echo reply.
So let's do that so no monitor session 1
we only gonna capture the traffic received on this port and then we'll send it out of port 1 0 5.
So now when I clear the session and do a ping notice we only receive half the traffic so be careful
which ports are the source of your capture.
And be careful of the direction of traffic.
Both will allow you to capture traffic in and out of that port receive is only traffic received on that
port transmit is traffic sent out of that port you could as an example capture on the V lan.
So let's get rid of session one and what I'll do is say v land one received traffic and the destination
will be port five I'll clear the Y shock capture
and do a single ping again and notice here we see both the echo and echo reply message so this echo
reply has echo request because this port and this port on V land.
This port 1 0 2 is actually shut down in this topology so we could delete that port from the topology
some show commands again show monitor we can see that we've got one session enabled it's a local session
we receiving traffic on VLAN 1 destination port is 1 0 5 we're using a native encapsulation and ingress
is disabled so traffic will be dropped that's received on this port we can also look at detailed information
so it's a local session they are no source ports configured we only have a source of V villain configured
and we capturing traffic received on VLAN 1 not transmitted on VLAN 1 a remote spend session is not
configured the destination port for the span session is 1 0 5 other options are not configured.