The following example will demonstrate how to configure a single SPAN session on a Cisco Catalyst switch. The specifics are different between different switch models, so be sure to check the Cisco documentation.
You must first configure source ports. Source ports are ports whose data will be copied, and sent to the destination, or SPAN port.
monitor session 1 source interface Gi1/0/1 – 28 rx
The above command will create a new SPAN session called “1? and configure ports 1-28 on the first switch in the stack as a source port. The training “rx” means that ingress traffic is what’s replicated.
Ports can also be skipped, and you can add additional ports with another “source” command:
monitor session 1 source interface Gi3/0/1 – 4 rx
Now that we’ve defined a few sources, we must now define where the traffic should be sent.
monitor session 1 destination interface Gi2/0/22
Defining an interface as the destination port, we have now just enabled this SPAN session. A server attached to Gi2/0/22 will now see all ingress traffic on the ports specified. Sources can be quite diverse, including RSPAN VLANs, which would be defined as:
monitor session 1 source vlan 555
The mixing of SPAN and RSPAN ports may or may not be supported on your device. In fact, RSPAN isn’t supported on all devices, so check the documentation to verify support for your particular equipment.
Configuring SPAN ports frequently results in losing connectivity with the connected monitoring device. Special attention needs to be paid to the ingress and egress concepts, and that the ports are configured properly.
what configs should i put on the destination port? shoud it be a switchport, access or trunk?
access port