Span or switched port and Eliza also called Porta murthering or port Mont. a train is a way to configure
a switch to make copies of Ethernet frames that are received on certain ports or certain villans.
You could say as an example that all traffic arriving on port gigabit to 1 0 1 gets copied out of another
port gigabit 1 0 2.
Or you could say that all traffic that's received or sent on the line 1 is copied out if gigabit 1 0
to spend becomes really important when you want to monitor traffic that's not destined to a specific
device.
As an example you may have a network analyzer or intrusion detection system that needs to monitor traffic
that traverses your network.
You can configure a switch to either make copies of frames out of a local port or as you'll learn later
use what is called Remote span where you copy frames from a local switch to a remote switch so that
a remote monitoring station can receive the traffic.
Now in this typology I'm not using Jeana's three Jeana's three and Cisco viral do not currently support
spam.
So what I'm using or physical Cisco rodders which are connected to 29 50 physical Siska switches which
in turn are connected to 37 50 Cisco switches.
I've got a PC connected to the thirty seven fifty switch and it's running Wireshark and we'll use it
to capture traffic from the network.
Now I'm going to demonstrate in a moment that when traffic is sent from one to router to another which
you unicast traffic such as pings or Telma it's all sent from one to rodded to the traffic will be sent
to the first 21:15 which in turn will be sent to the first 30 750 which in turn will be sent to the
30 7:52 switch and that will continue until the traffic arrives that brought it to the capturing PC
will not have visibility of unicast traffic.
Because when the Mac address table of switch one is populated it's simply going to switch the traffic
from this interface to for example this interface to forward the traffic Gerada to traffic is only going
to be sent out of this face if it's sent to unknown unicast addresses multicast addresses or broadcast
addresses or specifically sent to the capturing device.
So the capturing device will have no visibility of traffic sent from Rodda one to rodded to unlace we
enable spanne or port monitoring on the thirty seven fifty switch.
So firstly demonstrate that traffic sent from Radio 1 to Ratatouille is not received by the capturing
PC.
And then we'll configure span on the switch so that the PC is able to capture the traffic using Y shock.
The console of the thirty seven fifty switch show mac address table some mac addresses all listed in
the table
what I'll do now is ping from Route 1 to Rodda to show IP interface brief Ratto one has the IP address
and router to has the same IP address which we can see on the console of rockety.
So there's the IP address of rockety
Rodda one is once again able to ping wrote it too.
So when we look at the MAC address table office which one previously we only had those three MAC addresses
in the table.
But now notice we have this MAC address as well as the MAC address in the table.
I have configured the MAC address of Rotto one as follows.
So I'm using a Cisco Venda code MAC address and to make it simple I've specified the MAC address of
router one as follows.
On route to I've done something similar.
So the MAC address is the Cisco Venda code zeros and two.
So at this point the first thirty seven fifty switch has learnt about the MAC addresses of Radu 1 and
rodef two to keep things simple I haven't configured any villans all devices on villaine one let's capture
traffic.
Why shock on our PC.
So it's currently receiving some traffic.
But let's do a ping from Router one to Rodda to once again and all filter for ICMP traffic in the output.
Here you can see that the PC is not receiving any ICMP traffic from router 1 to router to and in the
same way if Rodda two pings are a one no ICMP traffic is shown on the capturing PC.
But if one pings the Windows PC which has an IP address of 10.0 one that one to a triple to
notice we see the ICMP packets.
So who why shock is able to capture traffic from 10 1 on one going to 10 1 1 2 2 2 so the piece is not
able to capture unicast traffic sent from Rodda one to route.
TE What about multicast traffic.
In this example you can see that the ICMP traffic was received to the multicast address so a one with
IP address 10.0 wondered wondered one is sending traffic to the multicast address 2:39 wondered wondered
one.
You can see as an example that the source MAC address of router one destination MAC address is 0 1 0
0 0 5 which is the multicast MAC address in IP version 4.
As you can see over there.
What about a broadcast of paying $10 one to one.
The.
And I'll just repeat this once as you can see here.
Broadcast traffic is being received by the PC.
So in other words unicast traffic cosigned from one to the capturing device is forded out of this port
and that's based on the mac address.
Shown here as learnt by the 750 switch on the PC
on have changed
the MAC address in Windows
touse a bunch of zeros and a 1 so the MAC address is
11 zeros followed by one and that was learnt by the switch on fast Ethernet 1 0 5 as shown over here.
So unicast traffic gets forwarded to the PC multicast traffic gets forwarded to the PC and that's because
multicast MAC addresses are not added to the MAC address table in the same way that a unique cost to
MAC addresses are broadcast.
Traffic is also forwarded to the PC.
So to summarize
I'll respond to the why Shaw captcha unicast traffic sent from a one to rodded 2 is not received by
the capturing device multicast traffic is received broadcast traffic is received.
If we want to capture traffic from Rodda one to write a two for troubleshooting as an example we would
need to enable spanne on this port or Merlene to use the other term so that traffic sent and received
on this port or the port on land one in the example is forded out of this port so that the capturing
device can see the traffic as another example.
If we telnet from rate a one to Ratatouille and log in the capturing device does not see the telnet
traffic so we can't see the session from wrote a one to rodded too.
And that's because the switch is doing what it's supposed to do.
It's forwarding traffic from this interface to this interface and not sending it out of unnecessary
ports.
So knowledge configfs span so that the capturing device can see the unicast traffic.