All right, welcome back. Now we're going to define span and the types of span. Okay? Now, what is this switch port analyzers or span and they work together. Okay, so let's just use the span feature to mirror traffic from one source on a switch port or VLAN to a destination port. Okay, and we'll look at a visualization in a sec.

This allows a monitoring device, such as a network analyzer or sniffer eye to be attached to the destination port for capturing traffic. So span will actually capture all that traffic and send it to a network analyzer. So you can see okay, what's going on now? Okay, that's what it does. Now, there's two types of spam. There's local fan, and there's remote ban or they call it our spam.

All right. Now, logo span again, source and destination are located on the local switch. Sources on one or more of the switch ports were most fan. If this is on the local switch who most fan RC is located on a different switch, where traffic is copied over a special purpose VLAN across trunks between switches from source to destination. That's all it is. All right.

And here's that visual, this is logos fan, okay now logos fan. So, this is only on one switch, one switch or one logical stack. If you have stackable switches, in other words, you must identify one source. Therefore one or more source interfaces and destination interface where it will be monitored. So what's happening here? The goal is to monitor all traffic coming from PCA.

So PCA here is this is the port gigabit 101 is the source the span source. The span destination though, is gig one zero 48 Which is this right here? Okay, this is going to the network analyzer. All right, the destination is PCB, that will be gig 102. So what happens once information going out way, there's going to be copies you can see says copied frames, it will take those copy frames, and send it to the analyzer. And then later on, you can go out and see what is going on when you're sending that information, whatever it may be.

It could be ICMP, could be HTTP could be DNS, it could be whatever was found with wanting to capture that, copy that and then send that up to the analyzer which knows, hey, there's the spam destination. There's a spam source, not our problem okay to that because this which is aware of destination and source for spam, and of course, is going through the VLAN. that span is on okay, but this is local, local support. Now the configuration our switches and the pirate tracer do not support it. Okay. You can configure one or more so simultaneous span sessions on a callus was the number of supported span sessions depends on the switch model.

Just like anything, like any hardware or software, you iOS that you have both does it have the feature first back on the switch? Okay. So there's, that's why when you're choosing things, you just can't say willy nilly, hey, I want that switch. I want this switch. I want that switch. No, what is it a uni and especially when you're gonna be monitoring your network, what iOS will be best for that?

Now a catalyst 3750 series can support only two sessions for the 6500 series can support up to 64 sessions. Now these are independent of each other. Okay, these are in the center. And here it is right here the configuration monitor session. One sort bothered monster session one source is this interface going both ways. Monster session one destination interface gigabit zero 48 which is obviously going up because this one right here, this is what we're talking about, right is going up to the network analyzer, there's your 101 and there's your one zero 48.

That's what this particular command is saying the source is PCA destination is PCB, but send it up to the analyzer. So, you can analyze that information that is local fan, one switch, several ports source and destination and then you tell it you know, more or less the nation will be the network analyzer. Keep in mind, those series of switches that can allow span how many sessions either two or full or 64. being 3750 or 60 504, and that each individual session is separate so you can monitor each individual session or span that's going on. All right. But again, it's a monitoring protocol monitoring protocol. Alright, that's it.

Let's go continue on to the next lecture.