So that was an example of basic span.
There are multiple options when you configure span so let's remove our current session and then specify
Monat to session.
Let's create a new one or one source port is going to be interface first Ethan at 2 1 0 3 in the example
and I'm only going to do receiving of traffic wanted to session destination
interface 1 0 5
rather 1 0 5 and hit enter.
Now I purposely are only creating one session with the same number to keep it simple but be aware that
you can create multiple spand sessions.
There are some dependencies rules with regard to span a span destination port can only be used with
one spend session at a time.
A span destination port can also not be a span source port.
When you create a span destination port the switch no longer treats that port as a stand Ethan at port.
As I demonstrated MAC addresses are not learned on that port and traffic received on that port is not
accepted by default.
You can remove a span destination port by using the no monitor session and the number and the destination
interface and then add it to a different monetisation.
So in other words you can move it from one session to another.
Multiple spand sources can be used with a single span's session one spand session cannot mix interfaces
and violent sources.
So you must either look at multiple interfaces or multiple villans one spend session can use any combination
of directions.
Transmit receive or both.
If the channel can be used as a source port in Port monitoring or spanne trunks can also be used as
source ports if required.
So in this example we've only got a single interface but we could change that too fast.
Ethernet 1 0 3 and then specify a range of interfaces if required.
So let's say 1 0 1 and typical Cisco fashion.
The command is different to other commons so do receive on both those interfaces.
Do show run pumping clewed monitor.
All in all examples span ports where you going to look at traffic received on 1 0 or 1 as well as 1
0 3 so all restart the washup capture on Rato one.
I'm going to send a single painting to Rodda too.
What you'll notice even though we are only looking at receiving of traffic we capture both ping echo
as well as Ekka reply.
So the Echo would have been received on this port when one transmit a traffic to rodded to the echo
reply would have been received on this port.
So hence we received both the echo and Echo reply.
If we had only configured this port we would only have received the echo and not the echo reply.
So let's do that and monitor session 1.
We only going to capture the traffic received on this port and then we'll send it out of port 1 0 5.
So now when I clear the session and do a ping noticed we only receive half the traffic.
So be careful which ports are the source of your capture and be careful of the direction of traffic
both will allow you to capture traffic in and out of that port receive is only traffic received on that
port.
Transmit is traffic sent out of that port.
You could as an example capture on the villain.
So let's get rid of Section 1 and what I'll do is say if Villalon one received traffic and the destination
will be port five playa the y shall capture
and do a single ping again.
And notice here we see both the echo and Echo reply message.
So this Ecker reply he has Ekka request because this port and this port on VLAN 1 pt. 1 0 2 is actually
shut down in this apology so we could reach that port from the topology some showed commands again show
to monitor.
We can see that we've got one session enabled.
It's a local session we are receiving traffic on VLAN 1 destination port is 1 0 5.
We are using a native encapsulation and ingress is disabled so traffic will be dropped.
That's received on the port.
We can also look at detailed information so it's a local session they are no source ports configure
it we only have a source of land configured and we capturing traffic received on VLAN one not transmitted
on the land one a remote spend session is not configured the destination port for the spend session
is 1 0 5 other options are not it.
So let's look at some of the options shoyu monetarist session all at the moment no spin configuration
is present on the system.
We can look at a local spanne we can even look at remote spanne remote span is used where you have a
different source and destination switch.
So the source port could be this port on switch too.
And the destination could be this port on switch one.
So traffic will be captured on this port and sent to the capturing device on this switch.
So which one so I'll configure a monitor session some monitor session.
Pick a number like one source interface.
First Ethan at 1 0 1 the destination in your example is going to be 1 0 5 so do show run pipe.
Include monitor.
That's what we've done.
If we try to configure a nut this session using the same destination port of interface if 1 0 5 noticed
we told that to that port is really being used.
So we configured this port as the destination of session 1.
We can't now configure it to be the destination for session 2 but we could as an example configure session
to and specify a different source.
So one 0 1 as an example a do show run popping clewed monitor.
We've got two sources configured but only one destination.
So show monitus session all we've got session 1 configure it and session to configure it but only session
one is configured with the destination port session 2 is not currently being used.
On one shock device we should be able to capture traffic from a one to Rodda to which we can see unicast
traffic sent from Rodda one to router to is being forwarded out of this port because of this monitoring
session.
Traffic sent and received on if one special one is going to be sent out of 1 0 5 and hence we see the
ICMP echo request an echo reply messages.
Now there's nothing stopping us moving the destination port from one session to another.
So we could put a note in front of that command will now move it to session 2.
So that's accepted.
So what we've done now is move the destination port from session to session to oh please.
That was a shock kept to do the ping again.
I noticed we capturing the traffic because we are capturing some the kind of traffic.
But in a different session.