SPAN, animated

SPAN, RSPAN and ERSPAN: a copy of the traffic, without stopping it

Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.

the original trafficthe SPAN / RSPAN copythe GRE / ERSPAN-encapsulated copy, CAPWAPcontrol protocols (ARP, BGP)packets sent to the CPU (EPC)lost copy, dropped packet or TCP RST dropped copy or broken link

TL;DR

A switch delivers a unicast frame only on the destination's port, so an analyzer on another port sees nothing. SPAN has the switch copy the frames from sources (ports, EtherChannels, VLANs; rx, tx or both) to a destination port, which leaves normal switching while it's a destination. RSPAN carries the copy to another switch through a VLAN marked remote-span, which doesn't learn MACs and must exist on every switch along the path. ERSPAN encapsulates it in GRE over IP and routes it anywhere, at the cost of 50 bytes and fragmentation at MTU 1500. Copies that don't fit into the destination are lost without affecting the real traffic; on NX-OS, sessions are shut by default and the destination needs switchport monitor. Most incidents: a session that was never started, an RSPAN VLAN missing on a transit switch, oversubscription, and an analyzer that strips the tags.

How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between IOS-XE, NX-OS, ACI and other vendors. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.

The analogy, in short

Think of a phone exchange and the quality-monitoring room: the exchange connects two phones without anyone else hearing, and the supervisor gets a copy of the call in his headset only if he gives the exchange a monitoring order. The headset is for listening only, a headset carries just one conversation clearly, and for another site the copy goes out over a dedicated internal line or in a sealed envelope sent by courier.

The model holds up to §8. From §9 on (capturing on the switch, Ethanalyzer, TAP, integrations), it gets stretched; see the full analogy and its limits in §13.