Switched Port Analyser (SPAN)

Switched Port Analyser technologies give a network administrator the ability to see a copy of the traffic that is transmitted on the wire.

The network device when configured with a SPAN technology will mirror all traffic at a data plane level for a specific criteria (port) to a destination. The destination could be a port on the local switch or a remote port connected to a traffic analyser.

Cisco switches provide three types of switched port analysers to make it possible to capture traffic:

1. Local Switched Port Analyser (SPAN): Capture local network traffic on the switch and send a copy of the network traffic to another port on the switch
2. Remote Switched Port Analyser (RSPAN): Capture local network traffic on the switch and send a copy of the network traffic through Layer 2 to a remote switch that is connected to a traffic analyser.
3. Encapsulated Remote Switched Port Analyser (ERSPAN): Capture local network traffic on the switch and send the traffic to a system through Layer 3 routing to a remote device connected to a traffic analyser.