Switched Port Analyzer
What SPAN does:
- SPAN port used to mirror traffic to another port where a probe or IDS sensor is connected
Benefit:
- Stops hackers before they can do damage
Otherwise, there is no easy way to shut down hackers after they have entered the network.
"Intruder Alert!"
"Intruder Alert!"
Attacker
Attacker
An IDS has the ability to detect misuse, abuse, and unauthorized access to networked resources. SPAN can be used to mirror traffic to another port where a probe or an IDS sensor is connected. When an IDS sensor detects an intruder, the sensor can send out a TCP reset that tears down the intruder connection within the network, immediately removing the intruder from the network.
You can analyze network traffic passing through ports or VLANs by using SPAN or Remote SPAN (RSPAN) to send a copy of the traffic to another port on the switch or on another switch that has been connected to a network analyzer or other monitoring or security device. SPAN copies (or mirrors) traffic received or sent (or both) on source ports or source VLANs to a destination port for analysis. SPAN does not affect the switching of network traffic on the source ports or VLANs. You must dedicate the destination port for SPAN use. Except for traffic that is required for the SPAN or RSPAN session, destination ports do not receive or forward traffic.
The example here shows how to set up SPAN session 1 for monitoring source port traffic to a destination port. First, any existing SPAN configuration for session 1 is deleted, and then bidirectional traffic is mirrored from source Gigabit Ethernet port 0/1 to destination Gigabit Ethernet port 0/2, retaining the encapsulation method.
Switch(config)# no monitor session 1
Switch(config)# monitor session 1 source interface gigabitethernet0/1 Switch(config)# monitor session 1 destination interface gigabitethernet0/2 encapsulation replicate
Switch(config)# end
© 2006 Cisco Systems, Inc. Securing LAN and WLAN Devices 2-55
Continue reading here: Wired Equivalent Privacy
Was this article helpful?