1 00:00:01,020 --> 00:00:04,990 So that was an example of basic span. 2 00:00:05,040 --> 00:00:12,640 There are multiple options when you configure span so let's remove our current session and then specify 3 00:00:12,800 --> 00:00:14,940 Monat to session. 4 00:00:15,400 --> 00:00:26,200 Let's create a new one or one source port is going to be interface first Ethan at 2 1 0 3 in the example 5 00:00:26,990 --> 00:00:34,950 and I'm only going to do receiving of traffic wanted to session destination 6 00:00:37,930 --> 00:00:40,380 interface 1 0 5 7 00:00:44,390 --> 00:00:48,540 rather 1 0 5 and hit enter. 8 00:00:48,590 --> 00:00:58,090 Now I purposely are only creating one session with the same number to keep it simple but be aware that 9 00:00:58,090 --> 00:01:01,520 you can create multiple spand sessions. 10 00:01:01,540 --> 00:01:08,920 There are some dependencies rules with regard to span a span destination port can only be used with 11 00:01:08,980 --> 00:01:11,390 one spend session at a time. 12 00:01:11,670 --> 00:01:16,530 A span destination port can also not be a span source port. 13 00:01:16,810 --> 00:01:24,030 When you create a span destination port the switch no longer treats that port as a stand Ethan at port. 14 00:01:24,310 --> 00:01:30,820 As I demonstrated MAC addresses are not learned on that port and traffic received on that port is not 15 00:01:30,910 --> 00:01:32,980 accepted by default. 16 00:01:33,070 --> 00:01:41,530 You can remove a span destination port by using the no monitor session and the number and the destination 17 00:01:41,530 --> 00:01:45,770 interface and then add it to a different monetisation. 18 00:01:45,970 --> 00:01:49,600 So in other words you can move it from one session to another. 19 00:01:49,600 --> 00:01:56,590 Multiple spand sources can be used with a single span's session one spand session cannot mix interfaces 20 00:01:56,650 --> 00:01:58,020 and violent sources. 21 00:01:58,210 --> 00:02:06,460 So you must either look at multiple interfaces or multiple villans one spend session can use any combination 22 00:02:06,520 --> 00:02:07,750 of directions. 23 00:02:07,780 --> 00:02:10,040 Transmit receive or both. 24 00:02:10,330 --> 00:02:18,430 If the channel can be used as a source port in Port monitoring or spanne trunks can also be used as 25 00:02:18,430 --> 00:02:20,740 source ports if required. 26 00:02:20,740 --> 00:02:27,550 So in this example we've only got a single interface but we could change that too fast. 27 00:02:27,550 --> 00:02:34,740 Ethernet 1 0 3 and then specify a range of interfaces if required. 28 00:02:35,110 --> 00:02:41,070 So let's say 1 0 1 and typical Cisco fashion. 29 00:02:41,090 --> 00:02:47,160 The command is different to other commons so do receive on both those interfaces. 30 00:02:47,200 --> 00:02:50,840 Do show run pumping clewed monitor. 31 00:02:50,900 --> 00:02:58,470 All in all examples span ports where you going to look at traffic received on 1 0 or 1 as well as 1 32 00:02:58,530 --> 00:03:04,720 0 3 so all restart the washup capture on Rato one. 33 00:03:04,720 --> 00:03:10,450 I'm going to send a single painting to Rodda too. 34 00:03:10,840 --> 00:03:17,590 What you'll notice even though we are only looking at receiving of traffic we capture both ping echo 35 00:03:17,890 --> 00:03:19,440 as well as Ekka reply. 36 00:03:19,720 --> 00:03:27,060 So the Echo would have been received on this port when one transmit a traffic to rodded to the echo 37 00:03:27,060 --> 00:03:29,820 reply would have been received on this port. 38 00:03:30,190 --> 00:03:35,060 So hence we received both the echo and Echo reply. 39 00:03:35,140 --> 00:03:42,700 If we had only configured this port we would only have received the echo and not the echo reply. 40 00:03:42,700 --> 00:03:51,380 So let's do that and monitor session 1. 41 00:03:51,490 --> 00:04:00,820 We only going to capture the traffic received on this port and then we'll send it out of port 1 0 5. 42 00:04:00,820 --> 00:04:10,480 So now when I clear the session and do a ping noticed we only receive half the traffic. 43 00:04:10,610 --> 00:04:16,790 So be careful which ports are the source of your capture and be careful of the direction of traffic 44 00:04:17,330 --> 00:04:22,790 both will allow you to capture traffic in and out of that port receive is only traffic received on that 45 00:04:22,790 --> 00:04:23,550 port. 46 00:04:23,780 --> 00:04:27,280 Transmit is traffic sent out of that port. 47 00:04:27,330 --> 00:04:31,110 You could as an example capture on the villain. 48 00:04:31,740 --> 00:04:43,810 So let's get rid of Section 1 and what I'll do is say if Villalon one received traffic and the destination 49 00:04:43,810 --> 00:04:48,530 will be port five playa the y shall capture 50 00:04:51,500 --> 00:04:53,390 and do a single ping again. 51 00:04:53,530 --> 00:04:58,640 And notice here we see both the echo and Echo reply message. 52 00:04:58,640 --> 00:05:10,910 So this Ecker reply he has Ekka request because this port and this port on VLAN 1 pt. 1 0 2 is actually 53 00:05:10,910 --> 00:05:20,010 shut down in this apology so we could reach that port from the topology some showed commands again show 54 00:05:20,010 --> 00:05:21,300 to monitor. 55 00:05:21,650 --> 00:05:24,800 We can see that we've got one session enabled. 56 00:05:24,890 --> 00:05:31,960 It's a local session we are receiving traffic on VLAN 1 destination port is 1 0 5. 57 00:05:32,280 --> 00:05:38,120 We are using a native encapsulation and ingress is disabled so traffic will be dropped. 58 00:05:38,360 --> 00:05:41,480 That's received on the port. 59 00:05:41,540 --> 00:05:50,630 We can also look at detailed information so it's a local session they are no source ports configure 60 00:05:50,700 --> 00:06:00,560 it we only have a source of land configured and we capturing traffic received on VLAN one not transmitted 61 00:06:00,650 --> 00:06:07,820 on the land one a remote spend session is not configured the destination port for the spend session 62 00:06:07,850 --> 00:06:14,700 is 1 0 5 other options are not it. 63 00:06:14,860 --> 00:06:25,360 So let's look at some of the options shoyu monetarist session all at the moment no spin configuration 64 00:06:25,930 --> 00:06:27,940 is present on the system. 65 00:06:28,030 --> 00:06:35,890 We can look at a local spanne we can even look at remote spanne remote span is used where you have a 66 00:06:36,190 --> 00:06:38,710 different source and destination switch. 67 00:06:39,010 --> 00:06:42,160 So the source port could be this port on switch too. 68 00:06:42,430 --> 00:06:45,920 And the destination could be this port on switch one. 69 00:06:46,180 --> 00:06:53,990 So traffic will be captured on this port and sent to the capturing device on this switch. 70 00:06:53,980 --> 00:07:00,580 So which one so I'll configure a monitor session some monitor session. 71 00:07:01,330 --> 00:07:05,270 Pick a number like one source interface. 72 00:07:05,500 --> 00:07:18,300 First Ethan at 1 0 1 the destination in your example is going to be 1 0 5 so do show run pipe. 73 00:07:18,330 --> 00:07:21,450 Include monitor. 74 00:07:21,570 --> 00:07:22,680 That's what we've done. 75 00:07:22,920 --> 00:07:34,780 If we try to configure a nut this session using the same destination port of interface if 1 0 5 noticed 76 00:07:34,780 --> 00:07:38,180 we told that to that port is really being used. 77 00:07:38,230 --> 00:07:42,990 So we configured this port as the destination of session 1. 78 00:07:43,150 --> 00:07:51,010 We can't now configure it to be the destination for session 2 but we could as an example configure session 79 00:07:51,050 --> 00:07:54,750 to and specify a different source. 80 00:07:54,760 --> 00:08:05,230 So one 0 1 as an example a do show run popping clewed monitor. 81 00:08:05,370 --> 00:08:10,530 We've got two sources configured but only one destination. 82 00:08:10,530 --> 00:08:21,050 So show monitus session all we've got session 1 configure it and session to configure it but only session 83 00:08:21,050 --> 00:08:25,790 one is configured with the destination port session 2 is not currently being used. 84 00:08:26,480 --> 00:08:35,060 On one shock device we should be able to capture traffic from a one to Rodda to which we can see unicast 85 00:08:35,060 --> 00:08:42,490 traffic sent from Rodda one to router to is being forwarded out of this port because of this monitoring 86 00:08:42,490 --> 00:08:43,260 session. 87 00:08:44,050 --> 00:08:54,400 Traffic sent and received on if one special one is going to be sent out of 1 0 5 and hence we see the 88 00:08:54,850 --> 00:09:02,370 ICMP echo request an echo reply messages. 89 00:09:02,380 --> 00:09:08,410 Now there's nothing stopping us moving the destination port from one session to another. 90 00:09:08,410 --> 00:09:16,110 So we could put a note in front of that command will now move it to session 2. 91 00:09:16,350 --> 00:09:18,170 So that's accepted. 92 00:09:18,180 --> 00:09:25,360 So what we've done now is move the destination port from session to session to oh please. 93 00:09:25,370 --> 00:09:30,050 That was a shock kept to do the ping again. 94 00:09:31,520 --> 00:09:37,030 I noticed we capturing the traffic because we are capturing some the kind of traffic. 95 00:09:37,260 --> 00:09:38,510 But in a different session.