Cisco Catalyst 3650 Series User Manual

You can monitor traffic on a single port or VLAN or on a series or range of ports or VLANs. You select a
series or range of interfaces or VLANs by using the [, | -] options.
If you specify a series of VLANs or interfaces, you must enter a space before and after the comma. If you
specify a range of VLANs or interfaces, you must enter a space before and after the hyphen (-).
EtherChannel ports can be configured as SPAN or RSPAN destination ports. A physical port that is a member
of an EtherChannel group can be used as a destination port, but it cannot participate in the EtherChannel group
while it is as a SPAN destination.
A port used as a destination port cannot be a SPAN or RSPAN source, nor can a port be a destination port for
more than one session at a time.
You can enable IEEE 802.1x authentication on a port that is a SPAN or RSPAN destination port; however,
IEEE 802.1x authentication is disabled until the port is removed as a SPAN destination. If IEEE 802.1x
authentication is not available on the port, the switch returns an error message. You can enable IEEE 802.1x
authentication on a SPAN or RSPAN source port.
If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic at
Layer 2.
Destination ports can be configured to function in these ways:
•
When you enter monitor session session_number destination interface interface-id with no other
keywords, egress encapsulation is untagged, and ingress forwarding is not enabled.
•
When you enter monitor session session_number destination interface interface-id ingress, egress
encapsulation is untagged; ingress encapsulation depends on the keywords that follow—dot1q or
untagged.
•
When you enter monitor session session_number destination interface interface-id encapsulation
replicate with no other keywords, egress encapsulation replicates the source interface encapsulation;
ingress forwarding is not enabled. (This applies to local SPAN only; RSPAN does not support
encapsulation replication.)
•
When you enter monitor session session_number destination interface interface-id encapsulation
replicate ingress, egress encapsulation replicates the source interface encapsulation; ingress encapsulation
depends on the keywords that follow—dot1q or untagged. (This applies to local SPAN only; RSPAN
does not support encapsulation replication.)
You can verify your settings by entering the show monitor privileged EXEC command. You can display
SPAN, RSPAN, FSPAN, and FRSPAN configuration on the switch by entering the show running-config
privileged EXEC command. SPAN information appears near the end of the output.
Examples
This example shows how to create a local SPAN session 1 to monitor both sent and received traffic on source
port 1 on stack member 1 to destination port 2 on stack member 2:
Device(config)# monitor session 1 source interface gigabitethernet1/0/1 both
Device(config)# monitor session 1 destination interface gigabitethernet1/0/2
This example shows how to delete a destination port from an existing local SPAN session:
Device(config)# no monitor session 2 destination interface gigabitethernet1/0/2
Command Reference, Cisco IOS XE Everest 16.5.1a (Catalyst 3650 Switches)
507
monitor session destination

Cisco Catalyst 3650 Series Specifications

General

Brand	Cisco
Model	Catalyst 3650 Series
Category	Switch
Language	English