Explains how an Ethernet switch listens to a port

There are many things worth learning about Ethernet switches. Here we will mainly introduce how Ethernet switches can listen on ports. In an Ethernet Switching environment, communication between two workstations is generally not intercepted by a third party. In some cases, we may need such listeners, such as protocol analysis, traffic analysis, and intrusion detection. Therefore, we can set the SPAN (SwitchedPortAnalyzer Switch Port Analyzer) feature of the Cisco switch, or early "port image" and "monitoring port" features.

The listening object can be one or more Ethernet switch ports or the entire VLAN. If the listening port ("Source Port") or VLAN and the port ("Target Port") connecting to the Monitoring Workstation are on the same switch, we only need to configure SPAN; if not on the same vswitch, You need to configure RSPAN (RemoteSPAN ). Different Ethernet switches have different SPAN restrictions. For example, the source port and target port of the 2900XL switch must be in the same VLAN, and some switches do not support RSPAN. For more information, see the device documentation. When configuring SPAN, we need to provide the source port, VLAN number, and target port.

4000/6000 CatOS switch:
Setspan6/176/19 // SPAN: the source port is 6/17, and the target port is 6/19.

2950/3550/IOS/6000IOS switch:
Monitorsession1local // SPAN
Monitorsession1sourceinterfacefastethernet0/17 both // source port, or a VLAN
Monitorsession1destinationinterfacefastethernet0/19 // target port

2900/3500 XL switch:
Interfacefastethernet0/19 // target port
Portmonitorfastethernet0/17 // Source Port

1900 vswitch: (or use the menu [M] Monitoring)
Monitor-portmonitored0/17 // source port (ports 0/17 and 0/18)
Monitor-portmonitored0/18
Monitor-portport0/19 // target port
Monitor-port // start monitoring

When configuring RSPAN, we must first define a vlan of the rspan type. If both the source host and target host are on the same Ethernet switch on a common VLAN, unicast communication between them does not need to be transmitted to another Ethernet switch through TRUNK, the RSPANVLAN needs to forward such communication on the TRUNK to ensure that the monitoring host can listen. On the Source switch, you need to set the listening port or VLAN to forward traffic to the RSPANVLAN (if the IOS switch is running, you need to set another port as the reflection port ); on the target switch, you need to set the information in the RSPANVLAN to be forwarded to the target port connecting to the monitoring host.

IOS switch, such as 3550:
3550 (config) # vlan900 // create RSPANVLAN
3550 (config-vlan) # remote-span

Monitorsession1remote // Source switch
Monitorsession1sourceinterfacefastethernet0/17 both // Source Port
Monitorsession1destinationremotevlan900reflector-portfastethernet0/20 // target RSPANVLAN, reflection Port

Monitorsession2remote // target Switch
Monitorsession2sourceremotevlan900 // RSPANVLAN
Monitorsession2destinationinterfacefastethernet0/19 // target port

CatOS switch, such as 6500:

Setvlan900rspan // create a RSPANVLAN
Setrspansource4/1-2900 // Source switch
Setrspandestination4/19900 // target Switch

After the last RSPAN configuration, some users reported that some network segments experienced severe packet loss. Check carefully and find that some Ethernet switches have heavy uplink port load. Further analysis showed that an RSPAN process was enabled on two central Ethernet switches, and the traffic on the RSPANVLAN was large, reaching 300 MB. Because the Pruning function is not enabled in The VTP domain, the traffic of this RSPANVLAN appears on all trunks, resulting in blocking. After the RSPANVLAN is trimmed from these trunks, the network returns to normal. The emergence of the SPAN function makes it more important to protect the switch from illegal control. If a hacker controls a host and some Ethernet switches, the hacker can use SPAN/RSPAN and Sniffer to snoop any information transmitted over the network.