Monitoring Cisco Switch Interfaces: A Step-By-Step Guide

Cisco switches have a variety of features that allow users to monitor interface activity. One such feature is the Switched Port Analyzer (SPAN), which can be used to capture LAN traffic for analysis. SPAN can be configured to monitor traffic entering or leaving a source port, or traffic that is bridged into a source VLAN. Another method is to use the 'show interfaces status inactive' command, which will display the status of inactive interfaces on the switch. Additionally, Cisco switches support the use of the Remote SPAN (RSPAN) feature, which enables remote monitoring of traffic from one or more SPAN sources distributed across multiple switches in a Fibre Channel fabric.

Monitor traffic using Switched Port Analyzer (SPAN)

Switched Port Analyzer (SPAN) is a feature that allows you to select and analyse network traffic on a Cisco switch. It is sometimes referred to as port mirroring or port monitoring. SPAN can be used to copy traffic from a single port, multiple ports, or an entire VLAN, and send it to a network monitoring connection on another port. This is often used for network traffic monitoring, such as for an intrusion-detection system.

• Connect to your Cisco switch: Use a program like PuTTY to connect to your Cisco switch via telnet, ssh, or serial. Enter the privileged EXEC mode using the 'enable' command and password.
• Enter configuration terminal mode: At the prompt, type "configure terminal" to enter configuration mode.
• Specify source and destination ports: In configuration mode, you need to define the source and destination ports for mirroring. For example, you can use "Fast Ethernet 1" as the source and "Fast Ethernet 8" as the destination.
• Set up the SPAN session: Use the "monitor session" command to create a SPAN session. Specify the session number, source interface, and destination interface. For instance, "monitor session 1 source interface Fa0/1" and "monitor session 1 destination interface Fa0/8".
• Start capture software: Launch a capture tool like Wireshark on your PC.
• Select the network interface: Choose the network interface that will be used for the capture.
• Capture network traffic: Allow the capture software to run and collect the desired network traffic.
• Turn off the monitor port: Once you have completed the capture, return to your connection and disable the monitor port using the "no monitor session" command.

Some general considerations to keep in mind:

• You may need two network cards or two computers for this process.
• Configuring a port as a SPAN will result in losing access to it for configuration purposes.
• Captures can become large if multicast audio is present on the mirrored port.
• Creating a mirror port may impact the CPU usage of your Cisco switch and affect network performance.

By following these steps, you can effectively monitor traffic using Switched Port Analyzer (SPAN) on a Cisco switch.

Monitor traffic using Remote SPAN (RSPAN)

Remote SPAN (RSPAN) is a feature that enables you to monitor traffic from multiple switches across your network. RSPAN extends the capabilities of a local SPAN by allowing you to monitor traffic from source ports or VLANs on different switches.

To configure RSPAN, you need to follow these steps:

Create an RSPAN VLAN:

Start by creating a new VLAN and configuring it as an RSPAN VLAN. This VLAN will be used to carry the monitored traffic between the source and destination switches. Make sure that this VLAN is not used for any user traffic and is only dedicated to RSPAN.

Configure the Source Switch:

On the source switch, create an RSPAN source session. Specify the source ports or VLANs that you want to monitor and associate them with the RSPAN VLAN. The monitored traffic will be copied into the RSPAN VLAN.

Configure Intermediate Switches (if any):

If there are any intermediate switches between the source and destination switches, make sure they are properly configured. Enable the RSPAN VLAN on these switches and ensure that trunking and IP routing are enabled.

Configure the Destination Switch:

On the destination switch, create an RSPAN destination session. Associate the destination port with the RSPAN VLAN. The destination port will receive all the monitored traffic from the source switches and can be connected to a network analyzer or security device.

On the Source Switch:

Switch(config)# vlan 100

Switch(config-vlan)# remote-span

Switch(config-vlan)# exit

Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 tx

Switch(config)# monitor session 1 source interface gigabitethernet1/0/2 rx

Switch(config)# monitor session 1 destination remote vlan 100

On the Destination Switch:

Switch(config)# monitor session 1 source remote vlan 100

Switch(config)# monitor session 1 destination interface gigabitethernet2/0/1

By following these steps, you can effectively monitor traffic using RSPAN on Cisco switches.

Monitor traffic using Fibre Channel Analyzers

Fibre Channel Analyzers can be used to monitor traffic on an interface without disrupting the network. This is especially useful in troubleshooting scenarios where traffic disruption changes the problem environment and makes it difficult to reproduce the problem.

To monitor traffic using Fibre Channel Analyzers, you need to physically connect a Fibre Channel Analyzer between the switch and the storage device to analyze the traffic through the interface. This type of connection has some limitations:

• It requires you to physically insert the Fibre Channel Analyzer between the two network devices.
• It disrupts traffic when the Fibre Channel Analyzer is physically connected.
• The analyzer captures data only on the Rx links in both port 1 and port 2. Port 1 captures traffic exiting the interface, while port 2 captures ingress traffic into the interface.

However, by using Switched Port Analyzer (SPAN), you can capture the same traffic scenario without any disruption. The Fibre Channel Analyzer uses the ingress (Rx) link at port 1 to capture all the frames exiting the interface and the ingress link at port 2 to capture all the ingress traffic on the interface.

To configure Fibre Channel Analyzers using SPAN:

• Configure SPAN on the interface in the ingress (Rx) direction to send traffic on the SD port using session 1.
• Configure SPAN on the interface in the egress (Tx) direction to send traffic on the SD port using session 2.
• Physically connect the SD port for session 1 to port 1 on the Fibre Channel Analyzer.
• Physically connect the SD port for session 2 to port 2 on the Fibre Channel Analyzer.

Alternatively, you can use a single SD port and one Fibre Channel Analyzer port to monitor bidirectional traffic on an interface. This setup is more advantageous and cost-effective, as it uses one SD port and one port on the analyzer instead of a full, two-port analyzer. To use this setup, the analyzer should be able to distinguish ingress and egress traffic for all captured frames.

Monitor traffic using Cisco Performance Monitor

Cisco Performance Monitor enables you to monitor the flow of packets in your network and become aware of any issues that might impact the flow before it starts to significantly impact the performance of the application in question. Performance monitoring is especially important for video traffic because high-quality interactive video traffic is highly sensitive to network issues. Even minor issues that may not affect other applications can have dramatic effects on video quality.

Configuration Components of Cisco Performance Monitor

To configure Cisco Performance Monitor, you need to configure many of the same basic elements that you would normally configure for Flexible NetFlow:

• Flow record
• Flow monitor
• Class
• Policy

Data That You Can Monitor Using Cisco Performance Monitor

You can monitor the following information by configuring a flow record with collect or match commands for the corresponding non-key fields:

• Flow to Interface Mapping
• IP Flow destination address and port, source address and port, and protocol
• RTP Synchronization Source (SSRC)
• Media Stream Packet Count
• Media Stream Octect Count
• Media Packet Loss Count
• Media Packet Loss Rate
• Packets Expected Count
• Media Loss Event Count
• Round Trip Time (RTT)
• Interarrival Jitter (RFC3550) max
• Interarrival Jitter (RFC3550) min 2
• Interarrival Jitter (RFC3550) mean
• Media Rate Variation
• Epoch of A Monitoring Interval
• Packet Forwarding Status
• DSCP and IPv6 Traffic Class
• TCP: Maximum Segment Size
• TCP: Window Size Maximum
• TCP: Window Size Average
• Out Of Order Packets

How to Configure Cisco Performance Monitor

Configuring a Flow Exporter for Cisco Performance Monitor

Flow exporters are used to send the data that you collect with Cisco Performance Monitor to a remote system such as a NetFlow Collection Engine. Each flow exporter supports only one destination. If you want to export the data to multiple destinations, you must configure multiple flow exporters and assign them to the flow monitor.

Configuring a Flow Record for Cisco Performance Monitor

The flow record specifies how the data collected data is aggregated and presented. You can specify the key and non-key fields that you want to monitor.

Configuring a Flow Monitor for Cisco Performance Monitor

Each flow monitor has a separate cache assigned to it and requires a record to define the contents and layout of its cache entries.

Configuring a Flow Class for Cisco Performance Monitor

The class specifies the filter that determines which flow traffic to monitor. The filter is configured using various match commands in class-map mode.

Configuring a Flow Policy for Cisco Performance Monitor

The class specifies which flow monitor is included.

Monitor traffic using Cisco Enterprise Network Compute System Switch Command

To monitor traffic using the Cisco Enterprise Network Compute System Switch Command, you can follow these steps and guidelines:

Create a SPAN or RSPAN Source Session:

Use the `monitor session source command in switch configuration mode. Specify the session number, source interface, and traffic direction. You can monitor traffic entering or leaving a source port or traffic bridged into a source VLAN. Here's an example command:

Nfvis(config-switch)# monitor session 1 source interfaces gigabitEthernet 1/1 both

Remove a Source Session:

Use the `no` form of the `monitor session source command to remove a source session. For example:

Nfvis(config-switch)# no monitor session 1 source interfaces gigabitEthernet 1/1

Create a SPAN or RSPAN Destination Session:

Use the `monitor session destination command in switch configuration mode. Specify the session number and destination interface. Here's an example:

Nfvis(config-switch)# monitor session 1 destination interfaces gigabitEthernet 1/3

Remove a Destination Session:

To remove a destination session, use the `no` form of the `monitor session destination command. For instance:

Nfvis(config-switch)# no monitor session 1 destination interfaces gigabitEthernet 1/3

Configure SPAN Sessions:

You can configure up to 16 SPAN sessions with multiple ingress (Rx) sources and a maximum of three SPAN sessions with one egress (Tx) port. Specify the session, destination interface, and source interface. Here's an example configuration:

Switch(config)# span session 1

Switch(config-span)# destination interface fc9/1

Switch(config-span)# source interface fc7/1

Configure RSPAN Sessions:

RSPAN sessions are similar to SPAN sessions but with a remote destination interface. You can have one source switch and one destination switch or multiple source and destination switches. Configure the VSAN interfaces, enable FC tunnels, initiate the FC tunnel, configure the ST port, and create an RSPAN session. Here's an example:

SwitchS(config)# span session 2

SwitchS(config-span)# destination interface fc-tunnel 100

SwitchS(config-span)# source interface fc1/1

Configure IGMP Snooping:

Use the `ip igmp` commands to configure Internet Group Management Protocol (IGMP) snooping. You can set the last-member query count, last-member query interval, query-max response time, query interval, and robustness. These settings help manage multicast groups and optimize network performance. For example:

Nfvis(config-switch-if)# ip igmp last-member-query-count 3

Frequently asked questions