Skip to content

Port Mirroring (SPAN)

SPAN (Switched Port Analyzer) copies traffic from one or more source ports (or a whole VLAN) to a destination port, so you can plug in a laptop running a packet capture tool and see traffic that wouldn't otherwise reach that port — useful for troubleshooting and for feeding an IDS/monitoring device.

Local SPAN

Source and destination on the same switch:

Cisco IOS — global configuration mode (conf t):

monitor session 1 source interface Gi0/1
monitor session 1 destination interface Gi0/10

Everything transmitted and received on Gi0/1 is now copied out Gi0/10 as well as delivered normally. A device plugged into Gi0/10 (running Wireshark or similar) sees a live copy of that traffic.

Monitoring a VLAN Instead of a Port

Capture everything within a VLAN, regardless of which physical port it enters on:

Note: SPAN configuration is additive — new monitor session commands add to whatever session 1 already has, and a session can't mix port sources and VLAN sources. If you configured the port example above, clear the session first with no monitor session 1 (global config) before entering the VLAN version.

Cisco IOS — global configuration mode (conf t):

monitor session 1 source vlan 10
monitor session 1 destination interface Gi0/10

Limiting Direction

By default both directions (both) are mirrored — restrict to one direction if you only need to see traffic going one way:

Cisco IOS — global configuration mode (conf t):

! Only traffic received on Gi0/1
monitor session 1 source interface Gi0/1 rx

RSPAN (Remote SPAN)

For capturing traffic on one switch but analyzing it from a device connected to a different switch, RSPAN carries the mirrored traffic across a dedicated RSPAN VLAN over a trunk between switches, rather than requiring the capture device to be physically local. More involved to set up (needs a reserved VLAN configured as remote-span on every switch in the path) — reach for it only when local SPAN genuinely can't reach where you need to capture from.

Removing a Session

The destination port stays out of normal service until the session is removed — when the capture is done, tear it down or you're left with a mystery dead port:

Cisco IOS — global configuration mode (conf t):

! Remove session 1 — the destination port returns to normal switching
no monitor session 1
! Clear every configured session
no monitor session all

Practical Notes

  • The destination port stops passing normal switched traffic while acting as a SPAN destination — don't pick a port with something else plugged into it, and remove the session when finished (see above).
  • Mirroring a busy uplink to a single destination port can oversubscribe that port if the source traffic exceeds what the destination link speed can carry — expect drops on the mirrored copy under heavy load, not on the original traffic.
  • Useful default troubleshooting move: SPAN the uplink to the Netgate firewall when investigating "is traffic actually leaving this VLAN" questions — see Netgate 6100 MAX Administration for the equivalent capture on that side.
  • When mirroring a trunk (like that uplink), add encapsulation replicate to the destination command — monitor session 1 destination interface Gi0/10 encapsulation replicate — otherwise the mirrored copy is sent untagged (native form) and Wireshark can't tell which VLAN each packet belonged to.

Verification

Cisco IOS — privileged EXEC:

! Confirm source/destination and direction
show monitor session 1
! List every configured session
show monitor session all