Adding additional SPAN port on Cisco switch 2950 not supported : to trunk/cascade with a C2960 without downtime

Posted on 2011-05-11
Last Modified: 2012-05-11

Currently on one of our Prod Cisco 2950, I have a SPAN port configured
& an IPS device is connected to this SPAN port .  I'm not sure if this SPAN
port is sniffing all traffic that pass thru this switch (ie its backplane?) or
only "monitor source" of a specific port only.

What's the command to find out if this SPAN port is mirroring one port
only (ie sniffing traffic for 1 port only) or sniffing all traffic that passes
thru the entire switch?

I need to add another promiscuous (ie Layer 2) device urgently to
a SPAN port on this switch which collects some other data but
this pair of "trunked-together" Cisco 2950 could only support 1
SPAN port.  I have a spare Cisco 2960, so how can I cascade or
 trunk this spare 2960 (which supports more than 1 SPAN port -
 we've tested that) without causing any downtime to the devices
on this pair of 2950 switches (IPS can be taken out for 30 minutes
to the newly trunked/cascaded 2960)

Kindly give as detailed commands, steps & instructions
Question by:sunhux
    LVL 26

    Assisted Solution

    With SPAN you only monitor the source port, not the entire switch.  You should be able to add the addional switch with no downtime. Just ensure the port you are uplinking the new switch to is configured properly as well as the port on the 2950. Make sure the configs of both ports match besides the description.
    LVL 26

    Assisted Solution

    Also, make sure you have spanning tree-enabled and port fast turned off on that uplink port.
    LVL 14

    Accepted Solution

    A1) "show monitor [ session <sess-#> ]" will show the source and destination ports.

    A2)  I'll suggest that you connect the 2960 with a trunk-port  to the 2950, and configure RSPAN on the 2950.  First, decide on an unused VLAN number to be used for RSPAN.  On the 2950 and 2960, configure the vlan for RSPAN:

    conf t
    vlan <VLAN-ID>

    Then, on the 2950, change the destination of the monitor session to the VLAN.  But for this, you need a port on the 2950 that use a reflector port.  It must be a physical port, and anything connected to it will lose connectivity as long as the RSPAN session is active.  The config is:

     monitor session <sess-#> destination remote vlan <VLAN-ID> reflector-port <Port-num>

    Then, on the 2960, you want to configure multiple destination ports.  Create a monitor session with the RSPAN VLAN as source, and the physical ports as destination:

     monitor session <sess-#> source remote vlan <VLAN-ID>
     monitor session <sess-#> destination interface <Port-num>

    Hope this helps...

    Author Comment


    Would u be able to provide sample configs for the uplink & downlink ports?

    Downlink port on the 2950 & uplink port on 2960?

    Or it's just a matter of using cross cables to link the 2960 to the
    pair of 2950s & no configuration needed?

    Pardon me, as I'm quite a newbie : how do I enable spanning
    tree & on which switches do I issue this command (pls provide)
    to enable spanning tree?
    LVL 14

    Assisted Solution

    The uplink/downlink ports on both switches can be configured as follows:
    int <Port-num>
     switchport trunk encapsulation dot1q
     switchport mode trunk

    You can use cross-cables for the link, but if I remember corectly, these switches support auto-MDI/MDIX, that will detect whther RX is on pin 1&2 or 3&6, so a straight cable should also work.

    Spanning-tree is by default enabled, but if you want to tweak it, there is a lot that can be configured.  You can get details for this at (for the 2960) and (for the 2950).  Handy reference material, but daunting in volume...

    Author Comment



    So Otto_N, with RSPAN (remote span), I don't have to move the IPS device
    (or any servers/equipment) which is (are) currently connected to the pair
    of 2950s?

    Author Comment


    Btw Otto,  Soulja mentioned that "port fast turned off on that uplink port"
    so what's the syntax that we need to add for the uplink interface?
    I suppose we don't need to do this on the downlink interface?

    Author Comment


    After configuring RSPAN, connecting a laptop running WireShark to
     the SPAN port on the new 2960 showed hardly any traffic.  What
    could be the reason?

    Author Comment


    The Wireshark only displayed multicast & broadcast traffic, so
    we're quite curious if there's anything wrong with the way we
    trunk the 2960 to the 2950?

    Author Comment


    When I googled for "RSPAN forward multicast traffic", there's some
    mention about RSPAN with 2950, so what should I do.  My current
    production (which I can't bring down) is a pair of 2950 & I have a pair
    of 2960s only (& no other spare switches)
    LVL 14

    Assisted Solution

    It's been night-time in my timezone, but I'll try to answer these questions:

    1) If you want to keep the IPS on the 2950, you just have to create another monitor session on the 2950 with source the RSPAN VLAN and destination the port.  The 2950 only supports 2 RSPAN sessions, of which only one can be a source session.  If the 2950 did support more sessions, you wouldn't need the 2960, as you could create a third monitor session with source the RSPAN VLAN and destination the port of the additional device.

    2) "Port Fast" is a spanning-tree protocol (STP) enhancement (by default disabled) that reduce the time STP take before forwarding traffic.  It is supposed to be configured only on access ports (ports that connect only to hosts), and some net-admins configure it by default on all ports that are not connected to other switches at the time of configuration.  If this is the case, and you want to connect a new switch, you will have to disable the Port-fast feature (use the "no spanning-tree portfast" command on the interface).  And it has to match on both ends of the link, so it has to be configured on both switches for the new trunk interfaces.

    3) There can be a couple of reasons:  First verify that the trunk port is working and allowing the RSAN VLAN and that the VLAN is active and not in STP Blocking state ("show interface trunk").  Then, using "show monitor" commands, verify that the source and destination on both swithes are correct. (On the 2950: Source = all ports you want monitored, Dest=RSPAN VLAN; on 2960: Source=RSPAN VLAN, Dest=Destination ports).  There are also conditions for the RSPAN VLAN (from the config guides listed above):
    – The RSPAN VLAN is not configured as a native VLAN.
    – No access port is configured in the RSPAN VLAN.
    – VLAN 1,1002-1005 cannot be used as RSPAN VLANs (use the ranges 2-1001 and 1006-4094)

    Other reasons for the lack of traffic could be filters on wireshark, or just that there isn't a lot of traffic being monitored.

    4)  SPAN and RSPAN also include multicast and broadcast traffic, but not exclusively.  Verify that your source RSP session is set-up for the correct ports and directions (tx, rx or both).

    Author Closing Comment

    Thanks v much

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Suggested Solutions

    This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
    This article is a step by step guide on how to create a basic PTP link using Ubiquiti airOS devices. This guide can be used on the following Ubiquiti AirMAX devices. Nanostation, Bullets, AirBridge, Nanobeam, NanoBridge to name a few. Please review …
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    9 Experts available now in Live!

    Get 1:1 Help Now