How to build an Ethernet switch Environment

In the IP address world, the service type is determined by the TCP or UDP port address of the terminal. the application range of the layer-4 Ethernet switch is the source end and the terminal IP address, most of the routing software is processed efficient optimization software, not simply copying the software in the router.

In an Ethernet Switching environment, communication between two workstations is generally not intercepted by a third party. In some cases, we may need such listeners, such as protocol analysis, traffic analysis, and intrusion detection. Therefore, we can set the SPAN (SwitchedPortAnalyzer Switch Port Analyzer) feature of the Cisco switch, or early "port image" and "monitoring port" features.

The listening object can be one or more Ethernet switch ports or the entire VLAN. If the listening port ("Source Port") or VLAN and the port ("Target Port") connecting to the Monitoring Workstation are on the same switch, we only need to configure SPAN; if not on the same vswitch.

You need to configure RSPAN (RemoteSPAN ). Different Ethernet switches have different SPAN restrictions. For example, the source port and target port of the 2900XL switch must be in the same VLAN, and some switches do not support RSPAN. For more information, see the device documentation. When configuring SPAN, we need to provide the source port, VLAN number, and target port.

4000/6000 CatOS switch:

 
 

  
  
Setspan6/176/19 // SPAN: the source port is 6/17, and the target port is 6/19.
  
  
 
  
  
2950/3550/IOS/6000IOS switch:
  
  
 
  
  
Monitorsession1local // SPAN
  
  
 
  
  
Monitorsession1sourceinterfacefastethernet0/17 both // source port, or a VLAN
  
  
 
  
  
Monitorsession1destinationinterfacefastethernet0/19 // target port
 
 

2900/3500 XL switch:

 
 

  
  
Setspan6/176/19 // SPAN: the source port is 6/17, and the target port is 6/19.
  
  
 
  
  
2950/3550/IOS/6000IOS switch:
  
  
 
  
  
Monitorsession1local // SPAN
  
  
 
  
  
Monitorsession1sourceinterfacefastethernet0/17 both // source port, or a VLAN
  
  
 
  
  
Monitorsession1destinationinterfacefastethernet0/19 // target port
 
 

When configuring RSPAN, we must first define a vlan of the rspan type. If both the source host and target host are on the same Ethernet switch on a common VLAN, unicast communication between them does not need to be transmitted to another Ethernet switch through TRUNK.

The RSPANVLAN needs to forward such communication on the TRUNK to ensure that the monitoring host can listen. On the Source switch, you need to set the listening port or VLAN to forward traffic to the RSPANVLAN (if the IOS switch is running, you need to set another port as the reflection port ); on the target switch, you need to set the information in the RSPANVLAN to be forwarded to the target port connecting to the monitoring host.

After the last RSPAN configuration, some users reported that some network segments experienced severe packet loss. Check carefully and find that some Ethernet switches have heavy uplink port load. Further analysis showed that an RSPAN process was enabled on two central Ethernet switches, and the traffic on the RSPANVLAN was large, reaching 300 MB.

Because the Pruning function is not enabled in The VTP domain, the traffic of this RSPANVLAN appears on all trunks, resulting in blocking. After the RSPANVLAN is trimmed from these trunks, the network returns to normal. The emergence of the SPAN function makes it more important to protect the switch from illegal control. If a hacker controls a host and some Ethernet switches, the hacker can use SPAN/RSPAN and Sniffer to snoop any information transmitted over the network.

1. Correct Interpretation and test of vswitch Port
2. Summarize the market status of high-end Switches
3. Focuses on core layer switch faults
4. PythonAndroid
5. Let's talk about the stacking of Ethernet switches.