Lab Objective
Configure a local SPAN session on a switch to mirror traffic from a source port to a destination monitoring port, and verify a packet capture tool connected to the destination port receives a copy of the source port's traffic.
Lab Purpose
Troubleshooting and security monitoring frequently require inspecting the actual traffic passing through a specific port without inserting a separate inline device — SPAN solves this by copying that traffic to a second port where a laptop running packet capture software can observe it non-disruptively.
Lab Topology
Switch1
Gi1/0/1 ---- PC-A (traffic to monitor)
Gi1/0/10 ---- Capture-Laptop (running
Wireshark or similar)Task 1: Configure a SPAN Session
Configure a SPAN session with Gi1/0/1 as the source and Gi1/0/10 as the destination.
Task 2: Verify the SPAN Session Configuration
Confirm the session shows the correct source and destination ports.
Task 3: Generate Traffic and Capture It
Generate traffic to and from PC-A, and confirm the capture laptop sees copies of that traffic.
Task 4: Verify the Destination Port Cannot Send Normal Traffic
Confirm the destination port behaves as a dedicated monitoring port rather than a normal access port.
Solution and Verification
Switch1(config)# monitor session 1 source interface gigabitethernet1/0/1
Switch1(config)# monitor session 1 destination interface gigabitethernet1/0/10
-- By default, this monitors both inbound
-- and outbound traffic on the source port
-- (equivalent to "both", the default direction)Switch1# show monitor session 1
Session 1
---------
Type : Local Session
Source Ports :
Both : Gi1/0/1
Destination Ports : Gi1/0/10
Encapsulation : Native
Ingress : DisabledPC-A> ping 192.168.1.1
-- Meanwhile, on Capture-Laptop running
-- Wireshark on Gi1/0/10:
Wireshark capture shows:
ICMP Echo Request from PC-A's MAC/IP
ICMP Echo Reply destined to PC-A's MAC/IP
-- The capture laptop, despite not being the
-- actual destination of this traffic, sees
-- a complete copy of everything traversing
-- Gi1/0/1-- Ingress traffic sourced FROM the capture
-- laptop itself is disabled by default on
-- a destination port, as shown in the
-- "Ingress: Disabled" line above -- this
-- prevents the monitoring port from
-- accidentally injecting traffic back into
-- the network it is observingKey Takeaway
A SPAN destination port is fundamentally different from a normal access port: it receives a copy of specified traffic for passive observation, and by default cannot send its own traffic back into the network, since its entire purpose is one-way visibility rather than normal bidirectional connectivity.