About listening to vswitch ports over Ethernet

What is a vswitch port? What is the role of the vswitch port? Vswitches cannot play their role in optimizing network performance. After reading this article, you will surely have a lot of GAINS. I hope this article will teach you more.

In an Ethernet Switching environment, communication between two workstations is usually not intercepted by a third party. In some cases, we may need such listeners, such as protocol analysis, traffic analysis, and intrusion detection. Therefore, we can set the SPAN (SwitchedPortAnalyzer Switch Port Analyzer) feature of the Cisco switch, or early "port image" and "monitoring port" features.

The listening object can be one or more Ethernet switch ports or the entire VLAN. If the listening port ("Source Port") or VLAN and the port ("Target Port") connecting to the Monitoring Workstation are on the same switch, we only need to configure SPAN;

4000/6000 CatOS switch:

 
 

  
  
Setspan6/176/19 // SPAN: the source port is 6/17, and the target port is 6/19.
  
  
 
  
  
2950/3550/IOS/6000IOS switch:
  
  
 
  
  
Monitorsession1local // SPAN
  
  
 
  
  
Monitorsession1sourceinterfacefastethernet0/17 both // source port, or a VLAN
  
  
 
  
  
Monitorsession1destinationinterfacefastethernet0/19 // target port
 
 

2900/3500 XL switch:

 
 

  
  
Setspan6/176/19 // SPAN: the source port is 6/17, and the target port is 6/19.
  
  
 
  
  
2950/3550/IOS/6000IOS switch:
  
  
 
  
  
Monitorsession1local // SPAN
  
  
 
  
  
Monitorsession1sourceinterfacefastethernet0/17 both // source port, or a VLAN
  
  
 
  
  
Monitorsession1destinationinterfacefastethernet0/19 // target port
 
 

If not on the same vswitch, You need to configure RSPAN (RemoteSPAN ). Different Ethernet switches have different SPAN restrictions. For example, the source port and target port of the 2900XL switch must be in the same VLAN, and some switches do not support RSPAN. For more information, see the device documentation. When configuring SPAN, we need to provide the source port, VLAN number, and target port.

When configuring RSPAN, we must first define a vlan of the rspan type. If both the source host and target host are on the same Ethernet switch on a common VLAN, unicast communication between them does not need to be transmitted to another Ethernet switch port through TRUNK.

The RSPANVLAN needs to forward such communication on the TRUNK to ensure that the monitoring host can listen. On the Source switch, you need to set the listening port or VLAN to forward traffic to the RSPANVLAN (if the IOS switch is running, you need to set another port as the reflection port ); on the target switch port, you must configure to forward the information in the RSPANVLAN to the target port connecting to the monitoring host.

IOS switch, such as 3550:

 
 

  
  
3550 (config) # vlan900 // create RSPANVLAN
  
  
 
  
  
3550 (config-vlan) # remote-span
  
  
 
  
  
Monitorsession1remote // Source switch
  
  
 
  
  
Monitorsession1sourceinterfacefastethernet0/17 both // Source Port
  
  
 
  
  
Monitorsession1destinationremotevlan900reflector-portfastethernet0/20 // target RSPANVLAN, reflection Port
  
  
 
  
  
Monitorsession2remote // target Switch
  
  
 
  
  
Monitorsession2sourceremotevlan900 // RSPANVLAN
  
  
 
  
  
Monitorsession2destinationinterfacefastethernet0/19 // target port
 
 

After the last RSPAN configuration, some users reported that some network segments experienced severe packet loss. Check carefully and find that some Ethernet switches have heavy uplink port load. Further analysis showed that an RSPAN process was enabled on two central Ethernet switches, and the traffic on the RSPANVLAN was large, reaching 300 MB.

Because the Pruning function is not enabled in The VTP domain, the traffic of this RSPANVLAN appears on all trunks, resulting in blocking. After the RSPANVLAN is trimmed from these trunks, the network returns to normal. The emergence of the SPAN function makes it more important to protect the switch from illegal control. If a hacker controls a host and some Ethernet switches, the hacker can use SPAN/RSPAN and Sniffer to snoop any information transmitted over the network.

1. Let's talk about the "potential rules" of the security switch"
2. Summarize the market status of high-end Switches
3. Security risks of LAN switches
4. PythonAndroid analyzes the differences and relationships between layer-3 switches and other layer Switches
5. Measure the Power Consumption Characteristics of LAN switches.