Analyze the powerful functions of Ethernet switch ports

The most important function of a vswitch is to speed up the fast data forwarding in a large local area network. The routing function is also used for this purpose, so the switch port issue is also very important, it is really not easy to set a vswitch port.

In an Ethernet Switching environment, communication between two workstations is usually not intercepted by a third party. In some cases, we may need such listeners, such as protocol analysis, traffic analysis, and intrusion detection. Therefore, we can set the SPAN (SwitchedPortAnalyzer Switch Port Analyzer) feature of the Cisco switch, or early "port image" and "monitoring port" features.

The listening object can be one or more Ethernet switch ports or the entire VLAN. If the listening port ("Source Port") or VLAN and the port connecting to the Monitoring Workstation ("Target Port") are on the same switch, we only need to configure SPAN.

 
 

  
  
4000/6000 CatOS switch:
  
  
 
  
  
Setspan6/176/19 // SPAN: the source port is 6/17, and the target port is 6/19.
  
  
 
  
  
2950/3550/IOS/6000IOS switch:
  
  
 
  
  
Monitorsession1local // SPAN
  
  
 
  
  
Monitorsession1sourceinterfacefastethernet0/17 both // source port, or a VLAN
  
  
 
  
  
Monitorsession1destinationinterfacefastethernet0/19 // target port
  
  
 
  
  
2900/3500 XL switch:
  
  
 
  
  
Setspan6/176/19 // SPAN: the source port is 6/17, and the target port is 6/19.
  
  
 
  
  
2950/3550/IOS/6000IOS switch:
  
  
 
  
  
Monitorsession1local // SPAN
  
  
 
  
  
Monitorsession1sourceinterfacefastethernet0/17 both // source port, or a VLAN
  
  
 
  
  
Monitorsession1destinationinterfacefastethernet0/19 // target port
  
  
 
 
 

If not on the same vswitch, You need to configure RSPAN (RemoteSPAN ). Different Ethernet switches have different SPAN restrictions. For example, the source port and target port of the 2900XL switch must be in the same VLAN, and some switches do not support RSPAN. For more information, see the device documentation. When configuring SPAN, we need to provide the source port, VLAN number, and target port.

When configuring RSPAN, we must first define a vlan of the rspan type. If both the source host and target host are on the same Ethernet switch on a common VLAN, unicast communication between them does not need to be transmitted to another Ethernet switch port through TRUNK.

• Analyze the working principle of enterprise-level switches from different perspectives
• Install a fixed port switch in Depth
• Working principle of smart switch with deep resolution
• Comprehensive introduction to features of layer-4 vswitches
• TMIS System of smart switch

The RSPANVLAN needs to forward such communication on the TRUNK to ensure that the monitoring host can listen. On the Source switch, you need to set the listening port or VLAN to forward traffic to the RSPANVLAN (if the IOS switch is running, you need to set another port as the reflection port ); on the target switch port, you must configure to forward the information in the RSPANVLAN to the target port connecting to the monitoring host.

 
 

  
  
IOS switch, such as 3550:
  
  
 
  
  
3550 (config) # vlan900 // create RSPANVLAN
  
  
 
  
  
3550 (config-vlan) # remote-span
  
  
 
  
  
Monitorsession1remote // Source switch
  
  
 
  
  
Monitorsession1sourceinterfacefastethernet0/17 both // Source Port
  
  
 
  
  
Monitorsession1destinationremotevlan900reflector-portfastethernet0/20 // target RSPANVLAN, reflection Port
  
  
 
  
  
Monitorsession2remote // target Switch
  
  
 
  
  
Monitorsession2sourceremotevlan900 // RSPANVLAN
  
  
 
  
  
Monitorsession2destinationinterfacefastethernet0/19 // target port
 
 

After the last RSPAN configuration, some users reported that some network segments experienced severe packet loss. Check carefully and find that some Ethernet switches have heavy uplink port load. Further analysis showed that an RSPAN process was enabled on two central Ethernet switches, and the traffic on the RSPANVLAN was large, reaching 300 MB.

Because the Pruning function is not enabled in The VTP domain, the traffic of this RSPANVLAN appears on all trunks, resulting in blocking. After the RSPANVLAN is trimmed from these trunks, the network returns to normal. The emergence of the SPAN function makes it more important to protect the switch from illegal control. If a hacker controls a host and some Ethernet switches, the hacker can use SPAN/RSPAN and Sniffer to snoop any information transmitted over the network.