Overview
SPAN, also known as Port Mirroring on non-Cisco devices, is a critical network monitoring capability built into managed switches. It allows network administrators to capture and analyze traffic flowing through switch ports by creating a copy of that traffic and sending it to a designated monitoring port where packet analysis tools can examine it. This non-intrusive monitoring technique is essential for network troubleshooting, security analysis, and performance optimization.
How SPAN Works
When SPAN is configured on a switch, the switch hardware duplicates packets traversing specified source ports and forwards these copies to a destination port. The original traffic continues unaffected, ensuring that legitimate network communication is not disrupted. The destination port typically connects to a packet analyzer, intrusion detection system (IDS), or other monitoring device.
SPAN operates at Layer 2 of the OSI model and can capture both ingress (incoming) and egress (outgoing) traffic, or both directions simultaneously. The switch itself performs the packet copying at hardware level, imposing minimal performance overhead.
SPAN Types and Configurations
Local SPAN
Local SPAN monitors traffic on ports within a single switch. All source and destination ports exist on the same physical switch. This is the most common SPAN configuration and requires minimal setup.
Remote SPAN (RSPAN)
Remote SPAN extends monitoring capabilities across multiple switches in a network. Mirrored traffic from source ports on one switch is forwarded across the network (typically via a dedicated VLAN) to a destination port on another switch. This enables centralized monitoring of distributed network segments.
Encapsulated Remote SPAN (ERSPAN)
ERSPAN encapsulates mirrored traffic within GRE (Generic Routing Encapsulation) tunnels, allowing SPAN to work across Layer 3 boundaries. This is more flexible than RSPAN and supports monitoring across routed networks and in virtualized environments.
Key Components and Concepts
Source Ports
The ports or VLANs whose traffic will be monitored. Multiple source ports can be designated in a single SPAN session. Traffic can be monitored in one direction (transmit or receive) or both directions (bidirectional).
Destination Port
The port where mirrored traffic is sent. This port connects to monitoring equipment such as packet analyzers, IDS sensors, or logging appliances. A destination port cannot simultaneously serve as a source port in the same SPAN session.
SPAN Session
A SPAN configuration instance that defines the relationship between source and destination. Most switches support multiple concurrent SPAN sessions, enabling simultaneous monitoring of different network segments.
Traffic Direction
SPAN can capture:
- Receive (RX): Traffic entering the source port from the network
- Transmit (TX): Traffic leaving the source port toward the network
- Both: Bidirectional traffic (default for most configurations)
Common Use Cases
Security Monitoring
SPAN feeds traffic to intrusion detection systems (IDS) and security information and event management (SIEM) systems that analyze packets for malicious patterns, suspicious behavior, and policy violations.
Network Troubleshooting
When network issues occur, administrators can mirror traffic from affected ports to a packet analyzer like Wireshark to diagnose connectivity problems, packet loss, or latency issues.
Performance Analysis
Network engineers use SPAN to collect baseline performance data, identify bandwidth hogs, and understand traffic patterns for capacity planning.
Compliance and Auditing
Many regulatory frameworks require network traffic capture capabilities for forensic investigation and audit trails. SPAN provides the mechanism to record traffic for compliance purposes.
Application Troubleshooting
Developers and support teams can analyze application-level protocol exchanges to diagnose data transmission issues without modifying application code.
Implementation Considerations
Bandwidth Impact
While SPAN minimally impacts switch CPU, the destination port must handle all mirrored traffic. If source ports carry 1 Gbps of traffic, the destination port must accommodate that 1 Gbps mirror copy in addition to any normal traffic on that port. Exceeding destination port capacity causes packet loss.
Performance Overhead
Most modern switches handle SPAN at the hardware level with negligible CPU impact. However, very high-traffic environments should be tested to ensure monitoring doesn't affect switching performance.
Configuration Limits
Switches have maximum limits on SPAN sessions and the number of source ports per session. Administrators should consult device specifications before implementing large-scale monitoring.
Monitoring Tool Preparation
The destination port must connect to equipment capable of handling the mirrored traffic volume. Tools should be configured to filter and analyze relevant traffic rather than attempting to process every packet.
Best Practices
- Document all active SPAN sessions to prevent confusion and ensure monitoring doesn't inadvertently expose sensitive traffic
- Use VLAN filtering where possible to reduce the volume of mirrored traffic
- Ensure destination ports have sufficient bandwidth to handle peak source port traffic
- Regularly review SPAN configurations and disable sessions no longer needed
- Combine SPAN with access control lists (ACLs) to monitor specific traffic types rather than all traffic
- For sensitive environments, encrypt or secure the path between SPAN source and destination, particularly in RSPAN scenarios
- Monitor the monitoring tool itself to ensure it's functioning and capturing data as expected
Limitations
SPAN cannot monitor encrypted traffic payload contents (only packet headers are visible for encrypted data). Additionally, SPAN does not capture traffic that never traverses the switch, such as traffic on interfaces not included in the SPAN session. Some switches limit the number of concurrent SPAN sessions or the total bandwidth that can be mirrored.
Alternatives and Related Technologies
NetFlow and sFlow provide flow-based monitoring as alternatives to packet mirroring, offering reduced bandwidth consumption but less packet-level detail. In virtualized environments, vSphere implements similar port mirroring capabilities. Tap devices (test access points) provide hardware-based traffic copying as an alternative to switch-based SPAN.