SPAN, RSPAN and RMON: capturing and measuring switch traffic

Why you need port mirroring

A switch forwards each unicast frame only out of the port where the destination lives. If you plug a laptop with Wireshark into a spare port, you will see your own traffic and broadcasts, but not the conversation between a user and a server. SPAN (Switched Port Analyzer), often called port mirroring, tells the switch to send a copy of chosen traffic to an analyser port. Security tools such as intrusion detection sensors and network performance monitors are fed the same way.

Local SPAN

monitor session 1 source interface GigabitEthernet1/0/10 both
monitor session 1 source vlan 20 rx
monitor session 1 destination interface GigabitEthernet1/0/24
show monitor session 1

Sources can be ports, EtherChannels or whole VLANs, in the receive (rx), transmit (tx) or both directions. The destination port stops behaving as a normal port and only sends the copies. Be aware of oversubscription: mirroring several busy 1 Gb/s ports in both directions to one 1 Gb/s destination drops copies, and the analyser misses packets. Mirror only what you need.

RSPAN and ERSPAN

When the analyser is on another switch, Remote SPAN carries the copies over a dedicated VLAN that must be allowed on every trunk between the two switches.

! on both switches and any switch in between
vlan 950
 name RSPAN
 remote-span
! source switch
monitor session 1 source interface GigabitEthernet1/0/10 both
monitor session 1 destination remote vlan 950
! destination switch
monitor session 1 source remote vlan 950
monitor session 1 destination interface GigabitEthernet1/0/24

MAC learning is turned off in the RSPAN VLAN, so the copies are simply flooded along it. ERSPAN (encapsulated remote SPAN) wraps the copies in GRE and sends them across a routed network, for example from a branch switch to a capture appliance in the data centre. Remember that mirrored traffic can contain passwords and personal data: restrict who can configure sessions and protect the analyser.

RMON: statistics and alarms built into the switch

RMON (Remote Monitoring) is a set of SNMP MIB groups that let the device itself collect statistics and watch thresholds, rather than relying on a management station to poll constantly. On Cisco switches the most used parts are:

• Statistics: per-interface counts of packets, broadcasts, multicasts, errors and frame sizes.
• History: the same counts sampled over intervals, so you can see a busy period afterwards.
• Alarms and events: an alarm watches any SNMP counter and, when it rises above or falls below a threshold, triggers an event that logs a message or sends an SNMP trap.

interface GigabitEthernet1/0/48
 rmon collection stats 1 owner netops
rmon event 1 log trap NETOPS description Uplink-errors owner netops
show rmon statistics
show rmon alarms

RMON alarms suit small sites without a full monitoring system. Larger networks usually rely on SNMP polling, streaming telemetry and flow records instead (see network monitoring).

Real-world example: slow card payments in a supermarket

A supermarket's card terminals took up to 20 seconds to approve payments. The network engineer set up a local SPAN session copying the payment gateway's switch port to a laptop running Wireshark. The capture showed repeated TCP retransmissions and an MTU problem on the VPN to the bank. To keep watching after the fix, the engineer configured RMON statistics on the uplink with an event that sends a trap if errors rise, and removed the SPAN session so the laptop port went back to normal use. For reading captures, see the Wireshark lab.