Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
SPAN ports 1
- Thread starter gerryw8s
- Start date
See Cisco's page:
Configuring the Catalyst Switched Port Analyzer (SPAN)
for configuration details.
Patrick
Patrick Bartkus, CCNP, CNX, SCM Sr. Network Engineer
GA Dept of Labor IT Network Services
If truth were not absolute, how could there be justice?
Configuring the Catalyst Switched Port Analyzer (SPAN)
for configuration details.
Patrick
Patrick Bartkus, CCNP, CNX, SCM Sr. Network Engineer
GA Dept of Labor IT Network Services
If truth were not absolute, how could there be justice?
-
1
- #3
AlfSutherland
Technical User
Hi,
Before I answer your questions, let me explain the following;
1. A Hub - is a device that duplicates the traffic going into one port to all the other ports on the hub eg every device plugged into it will see all the traffic
2. A Switch - is a device that looks at the network packets, and send it to the specific port that the packet needs to go to. Hence when you plug a sniffer into a switch port you will see no traffic (except Broadcasts and multicasts), as no traffic is being sent to that port.
When you "mirror" a port on a switch, you are basically telling the switch to send anything going "to or from" port X and duplicate it to port Y. This allows (usually a network analyser) to see whats occuring. The ability and functionality of the "mirroring" is totally dependant of the make and model of the switch. For some of the more expensive switches you can do multiple mirroring and/or even VLAN mirroring.
The term "SPAN" is a Cisco term only, so it's recommended to use the term mirroring when talking about non-Cisco kit.
With regard to how to do it (if at all possible) on your switch(es), speak to your switch Vendor/consult your docs.
I hope this helps,
Alf
Before I answer your questions, let me explain the following;
1. A Hub - is a device that duplicates the traffic going into one port to all the other ports on the hub eg every device plugged into it will see all the traffic
2. A Switch - is a device that looks at the network packets, and send it to the specific port that the packet needs to go to. Hence when you plug a sniffer into a switch port you will see no traffic (except Broadcasts and multicasts), as no traffic is being sent to that port.
When you "mirror" a port on a switch, you are basically telling the switch to send anything going "to or from" port X and duplicate it to port Y. This allows (usually a network analyser) to see whats occuring. The ability and functionality of the "mirroring" is totally dependant of the make and model of the switch. For some of the more expensive switches you can do multiple mirroring and/or even VLAN mirroring.
The term "SPAN" is a Cisco term only, so it's recommended to use the term mirroring when talking about non-Cisco kit.
With regard to how to do it (if at all possible) on your switch(es), speak to your switch Vendor/consult your docs.
I hope this helps,
Alf
AlfSutherland
Technical User
Hi,
The idea of matrix switxhes is to give maximum network visibilty for very little cost. A Matrix switch is a hardware device that allows a user to monitor a wide range of different network segments using one sniffer. (At any one time you can only see 1 segment, it does not combine the different ports together).
The Matrix switch ports are connected to a variety of stategic places across the network, in most instances these are "mirrored" ports on switches. The Matrix switch is then attached to a Sniffer Distributed monitor card.
There are a wide range of Matrix switches, varying in topology and port no.s. The main two are Datacom System ( and Netoptics ( For those who care - I prefere the Netoptics range!
After a little configuration on the Sniffer Agent (adding the matrix switch), when the Sniffer GUI is open you can swap between the different segments.
There is no real connection between the two (mirroring and matric switches), other than in reality you need to mirror switch ports onto Matrix switch ports.
Alf
The idea of matrix switxhes is to give maximum network visibilty for very little cost. A Matrix switch is a hardware device that allows a user to monitor a wide range of different network segments using one sniffer. (At any one time you can only see 1 segment, it does not combine the different ports together).
The Matrix switch ports are connected to a variety of stategic places across the network, in most instances these are "mirrored" ports on switches. The Matrix switch is then attached to a Sniffer Distributed monitor card.
There are a wide range of Matrix switches, varying in topology and port no.s. The main two are Datacom System ( and Netoptics ( For those who care - I prefere the Netoptics range!
After a little configuration on the Sniffer Agent (adding the matrix switch), when the Sniffer GUI is open you can swap between the different segments.
There is no real connection between the two (mirroring and matric switches), other than in reality you need to mirror switch ports onto Matrix switch ports.
Alf
- Thread starter
- #7
Alf's explanation was excellent and a very succinct summary of the important points. It is useful to clarify as people often hear the term matrix switch and assume that i'ts either a network switch of some sort or a true cross-point matrix switch (i.e. a sort of elctronically controlled patch panel). It is neither of those - it's simply a Layer 1 device that connects data collection or monitoring tools selectively to a variety of network ports or links, one at a time and by way of remote control.
The two brands mentioned are by far the predminant product available. Finisar offers a few switches that can be used only with their analyzers and Spirent still offers the LANhopper product (mostly the fiber versions Crystalhopper and Glasshoper) - these two companies are minor players in what is already a niche market.
In addition to SPAN port connectivity, there are products available (from both manufacturers) that may be used in-line by way of passive fiber taps and also for WAN serial links.
One last important distinction to mention: matrix switches and the "Configure Matrix Switch" or "Monitor Matrix Switch" pull down menus that appear in Sniffer Console are NOT way related to Sniffer's "Switch Expert" feature. That function relates to a MIB stat collecting feature and (ostensibly) a way to control SPAN source port selection from within the Sniffer menu (I say ostensbily because of of the last reports I heard, it does not always work as advertised).
Owen O'Neill
Datacom Systems Inc.
Northeastern SE
The two brands mentioned are by far the predminant product available. Finisar offers a few switches that can be used only with their analyzers and Spirent still offers the LANhopper product (mostly the fiber versions Crystalhopper and Glasshoper) - these two companies are minor players in what is already a niche market.
In addition to SPAN port connectivity, there are products available (from both manufacturers) that may be used in-line by way of passive fiber taps and also for WAN serial links.
One last important distinction to mention: matrix switches and the "Configure Matrix Switch" or "Monitor Matrix Switch" pull down menus that appear in Sniffer Console are NOT way related to Sniffer's "Switch Expert" feature. That function relates to a MIB stat collecting feature and (ostensibly) a way to control SPAN source port selection from within the Sniffer menu (I say ostensbily because of of the last reports I heard, it does not always work as advertised).
Owen O'Neill
Datacom Systems Inc.
Northeastern SE
- Status
Similar threads
- Locked
- Question