Using Local SPAN to Troubleshoot and Resolve Problems

A Switched Port Analyzer, or SPAN, is a way that you can monitor traffic. Back when networks used hubs, all traffic was visible because a hub just repeated the traffic out every port except the one it came in on. When switches were introduced, SPAN functionality was introduced to accommodate.

It is common to set a SPAN port up to a device with Wireshark to analyze network traffic. If you are going to monitor the traffic from a single management workstation, you will need two network interfaces cards (NIC) since SPAN traffic is not able traverse the same line as data. If you are only using the management station to monitor the traffic, you can use the single NIC. SPAN actually copies the data from one port to another that you specify. You can monitor egress traffic, ingress traffic, or a combination of the two.


When you configure a SPAN session, your source and destination ports cannot be the same. You will configure the source, what you want to monitor, to a destination interface, where you will monitor. The following is an example of the syntax you would use to configure a SPAN session.

Switch#configure terminal
Switch(config)#monitor session session-id source interface-id
Switch(config)#monitor session session-id destination interface-id


Switch#show monitor

ICMP Echo-Based IP SLA

Internet Control Message Protocol (ICMP) is a commonly used utility to test Layer 3 connectivity between devices. A Service Level Agreement (SLA) is a target that must be met; there is no set criteria for an SLA. ICMP echo-based IP SLA is a way to monitor end-to-end response time between Cisco devices using IPv4 or IPv6. According to Cisco, “Response time is computed by measuring the time taken between sending an ICMP Echo request message to the destination and receiving an ICMP Echo reply.” Using IP SLA ICMP echo to test far-end devices is much more practical than pinging manually.


Router#configure terminal
Router(config)#ip sla operation-number
Router(config-ip-sla)#icmp-echo {destination-ip-address | destination-hostname} [source-ip {ip-address | hostname} | source-interface interface-name
Router(config-ip-sla-echo)#frequency 300

The ‘ip sla operation-number’ begins configuration for an IP SLA operation and enters IP SLA configuration mode. Icmp-echo defines an ICMP Echo operation and enters IP SLA ICMP Echo configuration mode.  The frequesncy sets the rate at which a specified IP SLAs operation repeats.


You can verify the IP SLA configuration with the following show commands.

show ip sla configuration
show ip sla statistics


CCNA ICND2 Study Guide, 3rd Edition by Todd Lammle

Add and Remove VLANs on a Trunk

Where access ports allow for only one data VLAN and one voice VLAN, a trunk port can carry one or more VLANs. Generally, you would use a trunk to connect switches together where you need to carry traffic. In some cases, you would configure a trunk port to connect to a server, such as a virtual server. If the device needs to use more than one VLAN, then you will want to configure the port as a trunk port.


The following commands will set up the interface to trunk mode exclusively. This will turn off Dynamic Trunking Protocol (DTP). Depending on the hardware you are on, you may need to set the encapsulation mode. Most newer equipment and code should default to using 802.1Q encapsulation, though.

Switch#configure terminal
Switch(config)#interface interface-id
Switch(config-if)#switchport trunk encapsulation {dot1q | isl}
Switch(config-if)#switchport mode trunk

In order to add and remove VLANs on a trunk, you need to go to the interface and specify whether you want to add or remove VLANs.

To add one or more VLANs to the trunk:

Switch#configure terminal
Switch(config)#interface interface-id
Switch(config-if)#switchport trunk allowed vlan add vlan-id,vlan-id,vlan-id

To remove one or more VLANs from the trunk, you replace the add parameter with remove. It may appear odd that the allowed parameter is in the command but think of it like this, you are removing an allowed VLAN from the trunk.

Switch#configure terminal
Switch(config)#interface interface-id
Switch(config-if)#switchport trunk allowed vlan remove vlan-id,vlan-id,vlan-id


To verify what interfaces are trunks and what VLANs are configured, you would use the following command:

Switch#show interfaces trunk

You may also want to check the switchport configuration for the interface.

Switch#show interfaces interface-id switchport
Name: interface-id
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan: none
Trunking VLANs Enabled: All
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Appliance trust: none


When you try to set the interface to trunk mode, you may encounter an error message regarding the trunk encapsulation. This occurs on older hardware, but you may still see it. You just need to set the trunk encapsulation first, then go back to configuring the interface as a trunk.

Switch(config-if)#switchport mode trunk
Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.

Trunks will carry multiple VLANs only if they are created. If you look at the output of the show interfaces trunk command and do not see the VLANs you expect, ensure the VLANs are created on the device.