SPAN, RSPAN and ERSPAN: Choosing a Mirror Transport

Port mirroring looks like a one-line configuration until the capture arrives empty and the change window is closing. Cisco offers three transports - local SPAN, RSPAN and ERSPAN - and each fails in a different place: destination port capability, a VLAN carried across every trunk, or IP reachability and MTU on a routed path. This article maps the three, gives working configuration for each, and provides a verification order that separates "the session is wrong" from "the transport is wrong".

Pick the Transport by Where the Analyser Sits

• SPAN (local): source and destination on the same switch. Cheapest and fastest; the destination port becomes receive-only.
• RSPAN: analyser on a different switch in the same Layer 2 domain. Mirrored frames are placed into a dedicated remote-span VLAN and carried over trunks.
• ERSPAN: analyser behind a routed path. Mirrored frames are encapsulated (GRE-based) and sent to a collector IP address.

Local SPAN

Switch(config)# monitor session 1 source interface GigabitEthernet1/0/1 both
Switch(config)# monitor session 1 destination interface GigabitEthernet1/0/24
Switch# show monitor session 1

rx mirrors traffic before policy is applied, tx after - so a QoS or ACL investigation needs the right direction, and getting it backwards is the most common reason a capture looks "missing" packets.

RSPAN

! every switch in the path
Switch(config)# vlan 200
Switch(config-vlan)# remote-span

! source switch
Switch(config)# monitor session 10 source interface GigabitEthernet1/0/1 both
Switch(config)# monitor session 10 destination remote vlan 200

! destination switch
Switch(config)# monitor session 11 source remote vlan 200
Switch(config)# monitor session 11 destination interface GigabitEthernet1/0/24

The RSPAN VLAN must be dedicated, configured as remote-span on every participating switch, allowed on every trunk hop and in forwarding STP state. If VTP pruning or manual pruning is in use, remove the RSPAN VLAN from the prune list.

ERSPAN

! source
Router(config)# monitor session 1 type erspan-source
Router(config-mon-erspan-src)# source interface GigabitEthernet0/1/0 rx
Router(config-mon-erspan-src)# no shutdown
Router(config-mon-erspan-src)# destination
Router(config-mon-erspan-src-dst)# ip address 10.1.1.1
Router(config-mon-erspan-src-dst)# origin ip address 172.16.1.1
Router(config-mon-erspan-src-dst)# erspan-id 101

! destination
Switch(config)# monitor session 5 type erspan-destination
Switch(config-mon-erspan-dst)# destination interface GigabitEthernet2/2/1
Switch(config-mon-erspan-dst)# no shutdown
Switch(config-mon-erspan-dst)# source
Switch(config-mon-erspan-dst-src)# ip address 10.1.1.1
Switch(config-mon-erspan-dst-src)# erspan-id 101

Rules that cause most ERSPAN failures: the erspan-id must match on both ends; the ip address in the destination session must match the source session's destination address; ERSPAN does not fragment (the DF bit is set), so a path MTU below the encapsulated frame size silently drops packets; and every ERSPAN destination session on a switch must use the same IP address on the same interface.

Verification Order

1. Session: show monitor session all - correct source, correct direction, session up.
2. Source traffic: does the mirrored traffic actually exist (check interface counters on the source port)?
3. Transport: RSPAN - show interfaces trunk, show spanning-tree vlan 200; ERSPAN - show ip route to the collector plus a sourced ping.
4. Collector: promiscuous mode, correct decoder for the ERSPAN version your platform sends.

Related reading: Port mirroring and SPAN across vendors, tcpdump packet capture and BPF filters and 华为交换机端口镜像与观察端口配置.

原文链接：Cisco Learning Network: SPAN, RSPAN, ERSPAN