What is the difference between SPAN, RSPAN and ERSPAN, and when would you use each?
Show the answer
Say this first
All three copy traffic from source ports or VLANs to an analyzer. Local SPAN sends the copy to another port on the same switch. RSPAN carries the copy across layer 2 trunks in a dedicated remote-span VLAN to a port on another switch. ERSPAN wraps the copy in GRE and routes it over IP to a collector anywhere. I use SPAN when I can plug in at the switch, RSPAN inside one layer 2 campus, and ERSPAN across routed networks or into a central capture appliance.
Go deeper
| Local SPAN | RSPAN | ERSPAN | |
|---|---|---|---|
| Copy goes to | a port on the same switch | a port on another switch | an IP address |
| Transport | inside the switch | a remote-span VLAN on trunks | GRE over IP |
| Needs | nothing extra | the RSPAN VLAN allowed on every trunk in between | IP reachability and MTU headroom |
| Typical use | quick capture in a closet | central analyzer in a campus | data center, remote sites, capture appliances |
SW1(config)# monitor session 1 source interface GigabitEthernet1/0/5 both
SW1(config)# monitor session 1 destination interface GigabitEthernet1/0/48Limits to know before you trust a capture
- SPAN is best effort. Mirroring both directions of a busy 1G port into one 1G destination can exceed the destination's speed, and the extra copies are dropped silently. Gaps in the capture may be SPAN loss, not network loss.
- Errored frames are usually not copied. A frame that fails CRC is dropped on ingress, so SPAN will not show physical-layer damage. Counters show it.
- The destination port is no longer a normal port. By default it does not forward normal traffic.
- Platforms limit the number of sessions and sometimes the source types.
- A network TAP copies at the physical layer and does not drop under load, which makes it better evidence than SPAN for a dispute.
They will ask next
Your SPAN capture shows retransmissions but not the original segments. Is the network dropping them?
Not necessarily. Check output drops on the SPAN destination port, and capture at both ends of the flow if you can. SPAN may have dropped the copies.
Why mirror only rx when the source is a VLAN?
A frame entering one port in VLAN 10 and leaving another port in VLAN 10 is copied twice with
both, once on ingress and once on egress.rxgives you each frame once.
Traps
- Treating a SPAN capture as lossless proof.
- Forgetting to allow the RSPAN VLAN on every trunk between source and destination.