Infrastructure Services for CCNP Routing & Switching 300-115 SWITCH

Remote Switched Port Analyzer (RSPAN)
One of the limitations of the switched port analyzer or SPAN is that the source interface or VLAN and the destination interface must be on the same switch. To solve that problem, Cisco created remote SPAN or (R)SPAN. That's good news for us and here's some more good news. If you understand SPAN, understanding (R)SPAN is a piece of cake. The way (R)SPAN works is simple. Let's say you've got a server connected to a switch and you want to mirror traffic to and from this server. On another switch you've got a packet sniffer which you want to receive the mirrored traffic from the server. Between the two switches you've got a trunk link or maybe a couple of trunk links. (R)SPAN uses this trunk link to carry that mirrored traffic from the switch where the server is connected, to the switch where the packet sniffer is connected. So how does (R)SPAN achieve this? Well, there's really only one thing you need in (R)SPAN that you don't need in regular SPAN and that is a remote SPAN VLAN or (R)SPAN VLAN. A remote SPAN VLAN is a special VLAN that you create for the sole purpose of carrying mirrored traffic. You have to create this VLAN on both switches, the switch connected to your source and the switch connected to your sniffer. In this final module for the course, you're going to learn how to configure (R)SPAN, of course, and then we'll go over the course summary.