SPAN Destination Port State
Posted on July 29th, 2008 by hengdu
The fact is, when we assign a FastEthernet port to be a destination port for SPAN, its “line of protocol is down”. It’s by design according to Cisco Document. Later, I noticed that, even though there is no connection for destination port, the LED is still green to indicate forwarding status. So, The conclusion is, the destination port should be only used for network analyzer. It won’t forward any traffic. The following is the list of destination port characteristics.
A destination port must reside on the same switch as the source port (for a local SPAN session). A destination port can be any Ethernet physical port. A destination port can participate in only one SPAN session at a time. A destination port in one SPAN session cannot be a destination port for a second SPAN session. A destination port cannot be a source port. A destination port cannot be an EtherChannel group. A destination port can be a physical port that is assigned to an EtherChannel group, even if the EtherChannel group has been specified as a SPAN source. The port is removed from the group while it is configured as a SPAN destination port. The port does not transmit any traffic except that traffic required for the SPAN session unless learning is enabled. If learning is enabled, the port also transmits traffic directed to hosts that have been learned on the destination port. The state of the destination port is up/down by design. The interface shows the port in this state in order to make it evident that the port is currently not usable as a production port. If ingress traffic forwarding is enabled for a network security device. The destination port forwards traffic at Layer 2. A destination port does not participate in spanning tree while the SPAN session is active. When it is a destination port, it does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP). A destination port that belongs to a source VLAN of any SPAN session is excluded from the source list and is not monitored. A destination port receives copies of sent and received traffic for all monitored source ports. If a destination port is oversubscribed, it can become congested. This congestion can affect traffic forwarding on one or more of the source ports.
Discussion Area - Leave a Comment