Thursday, July 10, 2014

SPAN Destination ports and VLAN Membership

Recently at work, a discussion sprouted up around how to handle/configure local session Switched Port Analyzer (SPAN) destination ports.  A suggestion was made to create a new VLAN just for these SPAN destination ports and place them there.  The justification was that they would be out of VLAN 1, and easily identifiable.  Personally I thought it was a waste of a VLAN for a few simple SPAN destination ports, as SPAN destination ports do not participate in spanning tree, and do not forward traffic.  However, ultimately in this case it was a good decision due to security requirements.
Some key characteristics to know about SPAN destination ports:
    • A destination port can be a physical port that is assigned to an EtherChannel group, even if the EtherChannel group has been specified as a SPAN source. The port is removed from the group while it is configured as a SPAN destination port.
    • The port does not transmit any traffic except that traffic required for the SPAN session unless learning is enabled.
    • The state of the destination port is up/down by design. The interface shows the port in this state in order to make it evident that the port is currently not usable as a production port.
    • If ingress traffic forwarding is enabled for a network security device. The destination port forwards traffic at Layer 2.
    • A destination port does not participate in spanning tree while the SPAN session is active.
    • When it is a destination port, it does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP).
    • A destination port that belongs to a source VLAN of any SPAN session is excluded from the source list and is not monitored.
    • A destination port receives copies of sent and received traffic for all monitored source ports. If a destination port is oversubscribed, it can become congested. This congestion can affect traffic forwarding on one or more of the source ports.
    • When you configure a port as a SPAN destination, it is dedicated for use only by the SPAN feature.
    • Destinations, by default, cannot receive any traffic. With Release 12.2(33)SXH and later releases, you can configure Layer 2 destinations to receive traffic from any attached devices.
    • Destinations, by default, do not transmit anything except SPAN traffic. Layer 2 destinations that you have configured to receive traffic can be configured to learn the Layer 2 address of any devices attached to the destination and transmit traffic that is addressed to the devices.
Some of the points above seem like repeats and that was done on purpose to emphasize the point.  Probably the most important point is the one about the port being in an Up/Down status.  To me, this would naturally indicate that it is doing nothing outside of its SPAN function.


  1. Hi! I know this is kind of off-topic however I had to ask. Does running a well-established blog such as yours take a large amount of work? I'm brand new to blogging however I do write in my journal everyday. I'd like to start a blog so I will be able to share my own experience and views online. Please let me know if you have any kind of recommendations or tips for brand new aspiring blog owners. Thankyou!

    1. Hi Ed! I haven't touched the blog in years - just too busy between a busy job (versus the not busy job when I was doing these blog articles), family with four kids, and a side hustle DJing. Things have probably changed, so best you do your own exploration.. but really it's just finding your workflow and working through the formatting nuances of any given blog site/template. It becomes second nature after a while and it's pretty fun and you learn alot doing this kind of stuff - highly recommend!

  2. It's remarkable to pay a quick visit this site and reading the views of all mates about this article, while I am also zealous of getting know-how.