1 00:00:00,760 --> 00:00:09,100 Span or switched port analyzer also called port mirroring or port monitoring, is a way to configure 2 00:00:09,130 --> 00:00:16,630 a switch to make copies of Ethernet frames that are received on certain ports or certain VLANs. 3 00:00:17,170 --> 00:00:23,740 You could say as an example that all traffic arriving on Port Gigabit101 gets copied out of 4 00:00:23,740 --> 00:00:26,200 another port gigabit102 5 00:00:26,980 --> 00:00:33,550 or you could say that all traffic that's received or sent on VLAN 1 is copied out of gigabit1 6 00:00:33,550 --> 00:00:41,530 02. Span becomes really important when you want to monitor traffic that's not destined to a specific 7 00:00:41,530 --> 00:00:42,190 device. 8 00:00:42,790 --> 00:00:48,880 As an example, you may have a network analyzer or intrusion detection system that needs to monitor 9 00:00:48,880 --> 00:00:51,040 traffic that traverses your network. 10 00:00:51,640 --> 00:00:59,170 You can configure a switch to either make copies of frames out of a local port or, as you'll learn 11 00:00:59,170 --> 00:01:06,520 later, use what is called remote SPAN where you copy frames from a local switch to a remote switch 12 00:01:06,700 --> 00:01:10,030 so that a remote monitoring station can receive the traffic. 13 00:01:10,970 --> 00:01:18,110 Now, in this topology, I'm not using GNS3, GNS3 and Cisco VIRL do not currently 14 00:01:18,110 --> 00:01:19,060 support span. 15 00:01:19,670 --> 00:01:28,070 So what I'm using are physical Cisco routers which are connected to 2950 physical Cisco switches, which 16 00:01:28,070 --> 00:01:31,640 in turn are connected to 3750 Cisco switches. 17 00:01:32,640 --> 00:01:40,290 I've got a PC connected to the 3750 switch, and it's running Wireshark, and we'll use it to capture 18 00:01:40,290 --> 00:01:41,530 traffic from the network. 19 00:01:42,330 --> 00:01:48,030 Now, I'm going to demonstrate in a moment that when traffic is sent from router 1 to router 2 in other 20 00:01:48,030 --> 00:01:54,990 words, unicast traffic such as pings or telnet are sent from router 1 to router 2. The traffic will 21 00:01:54,990 --> 00:02:02,910 be sent to the first 2950, which in turn will be sent to the first 3750, which in turn will be sent 22 00:02:02,910 --> 00:02:04,770 to the 3752 switch 23 00:02:05,400 --> 00:02:09,110 and that will continue until the traffic arrives at router 2. This 24 00:02:09,120 --> 00:02:18,060 capturing PC will not have visibility of unicast traffic because when the Mac address table of switch 25 00:02:18,060 --> 00:02:24,480 1 is populated, it's simply going to switch the traffic from this interface too, for example, this 26 00:02:24,480 --> 00:02:30,300 interface to forward the traffic to router 2. Traffic is only going to be sent out of this interface 27 00:02:31,430 --> 00:02:38,990 if it's sent to unknown unicast addresses, multicast addresses or broadcast addresses or specifically 28 00:02:38,990 --> 00:02:45,830 sent to this capturing device. So the capturing device will have no visibility of traffic sent from 29 00:02:45,830 --> 00:02:53,270 router 1 to router 2 unless we enable SPAN or port monitoring on the 3750 switch. 30 00:02:53,840 --> 00:02:59,810 So I'll firstly demonstrate that traffic sent from router 1 to router 2 is not received by the capturing 31 00:02:59,810 --> 00:03:00,440 PC 32 00:03:00,920 --> 00:03:06,110 and then we'll configure SPAN on the switch so that the PC is able to capture the traffic 33 00:03:06,110 --> 00:03:15,530 using Wireshark. Here's the console of the 3750 switch show Mac address table. 34 00:03:18,060 --> 00:03:20,760 So Mac addresses are listed in the table. 35 00:03:24,100 --> 00:03:36,580 What I'll do now is ping from router 1 to router 2 show IP interface brief router 1 has this IP 36 00:03:36,580 --> 00:03:44,410 address and router 2 has this IP address, which we can see on the console of router 2. 37 00:03:46,400 --> 00:03:48,380 So there is the IP address of router 2 38 00:03:51,510 --> 00:03:54,340 router 1 is once again able to ping router 2. 39 00:03:54,960 --> 00:03:58,050 So when we look at the Mac address table of switch 1. 40 00:03:59,920 --> 00:04:07,540 Previously, we only had those three Mac addresses in the table, but now notice we have this Mac address 41 00:04:08,140 --> 00:04:16,870 as well as this Mac address in the table. I have configured the Mac address of router 1 as follows. 42 00:04:17,560 --> 00:04:20,950 So I'm using a Cisco Vendor Code Mac address 43 00:04:21,399 --> 00:04:28,660 and to make it simple, I've specified the Mac address of router 1 as follows, on router 2 I've done something 44 00:04:28,660 --> 00:04:29,180 similar. 45 00:04:29,530 --> 00:04:35,440 So Mac address is the Cisco Vendor Code 0s and a 2. 46 00:04:36,590 --> 00:04:44,150 So at this point, the first 3750 switch has learnt about the Mac addresses of router 1 and router 47 00:04:44,150 --> 00:04:48,200 2 to keep things simple, I haven't configured any VLANs, 48 00:04:48,620 --> 00:04:50,300 all devices on VLAN 1. 49 00:04:51,410 --> 00:05:00,380 Let's capture traffic in Wireshark on our PC, so it's currently receiving some traffic 50 00:05:02,410 --> 00:05:12,670 but let's do a ping from router 1 to router 2 once again and I'll filter for ICMP traffic. 51 00:05:13,810 --> 00:05:21,610 In the output here, you can see that the PC is not receiving any ICMP traffic from router 1 to router 52 00:05:21,610 --> 00:05:21,850 2 53 00:05:23,660 --> 00:05:31,310 and in the same way, if router 2 pings router 1, no ICMP traffic is shown on the capturing 54 00:05:31,310 --> 00:05:31,970 PC 55 00:05:33,990 --> 00:05:35,820 but if router 1 ping's 56 00:05:37,150 --> 00:05:42,430 this Windows PC, which has an IP address of 10.1.1.2.2.2 57 00:05:46,020 --> 00:05:54,420 Notice we see the ICMP packets, so Wireshark is able to capture traffic from 10.1.1.1 going 58 00:05:54,420 --> 00:05:56,940 to 10.1.1.2.2.2. 59 00:05:58,480 --> 00:06:02,260 So the PC is not able to capture 60 00:06:03,250 --> 00:06:09,640 unicast traffic sent from router 1 to router 2. What about multicast traffic? 61 00:06:11,760 --> 00:06:17,760 In this example, you can see that the ICMP traffic was received to the multicast address. 62 00:06:19,360 --> 00:06:25,180 So router 1 with IP address, 10.1.1.1 is sending traffic to the multicast address 63 00:06:25,180 --> 00:06:27,430 239.1.1.1, 64 00:06:30,420 --> 00:06:36,060 you can see as an example that the source Mac address is router 1 destination Mac address is 01 65 00:06:36,060 --> 00:06:42,960 005E which is the multicast Mac address in IPV4 as you can see over there. 66 00:06:44,370 --> 00:06:49,140 What about a broadcast? So I'll ping 10.1.1.1.255 67 00:06:50,040 --> 00:06:51,930 and I'll just repeat this once. 68 00:06:53,860 --> 00:06:59,270 As you can see here, broadcast traffic is being received by the PC. 69 00:07:00,040 --> 00:07:07,840 So in other words, unicast traffic is sent from router 1 to the capturing device is forwarded out of 70 00:07:07,840 --> 00:07:08,410 this port 71 00:07:10,530 --> 00:07:12,330 and that's based on the Mac address 72 00:07:15,230 --> 00:07:21,830 shown here, as learnt by the 3750 switch. On this PC 73 00:07:26,590 --> 00:07:27,910 I have changed 74 00:07:31,050 --> 00:07:32,820 the Mac address in Windows 75 00:07:35,880 --> 00:07:40,980 to a bunch of 0s and a 1, so the Mac address is 76 00:07:43,970 --> 00:07:53,150 eleven 0s followed by a 1, and that was learnt by the switch on fast Ethernet 105 as shown 77 00:07:53,420 --> 00:07:54,110 over here. 78 00:07:54,860 --> 00:08:01,160 So unicast traffic gets forwarded to the PC, multicast traffic gets forwarded to the PC 79 00:08:02,910 --> 00:08:09,300 and that's because multicast Mac addresses are not added to the Mac address table in the same way that 80 00:08:09,300 --> 00:08:14,850 unicast Mac addresses are broadcast traffic is also forwarded to the PC. 81 00:08:15,420 --> 00:08:16,380 So to summarize, 82 00:08:20,550 --> 00:08:22,440 I'll restart the wireshark capture 83 00:08:24,890 --> 00:08:29,720 Unicast traffic sent from router 1 to router 2 is not received by the capturing device. 84 00:08:31,180 --> 00:08:33,400 Multicast traffic is received. 85 00:08:35,539 --> 00:08:37,789 Broadcast traffic is received. 86 00:08:38,870 --> 00:08:45,110 If we want to capture traffic from router 1 to router 2 for troubleshooting as an example, we would 87 00:08:45,110 --> 00:08:50,630 need to enable SPAN on this port or mirroring to use the other term. 88 00:08:51,760 --> 00:08:58,300 So the traffic sent and received on this port or this port or on VLAN 1 in this example is forwarded 89 00:08:58,540 --> 00:09:04,660 out of this port so that the capturing device can see the traffic. As another example if we telnet from 90 00:09:04,660 --> 00:09:04,810 router 91 00:09:04,850 --> 00:09:07,360 1 to router 2 and log in, 92 00:09:08,320 --> 00:09:12,970 the capturing device does not see the telnet traffic. 93 00:09:13,900 --> 00:09:18,540 So we can't see the session from router 1 to router 2 94 00:09:18,910 --> 00:09:21,640 and that's because the switch is doing what it's supposed to do. 95 00:09:22,150 --> 00:09:28,600 It's forwarding traffic from this interface to this interface and not sending it out of unnecessary 96 00:09:28,600 --> 00:09:29,140 ports. 97 00:09:29,740 --> 00:09:34,720 So now let's configure span so that the capturing device can see the unicast traffic.