Question

A network engineer is configuring a local SPAN session on a Catalyst 9300 to capture traffic from an application server for analysis. The engineer enters:

monitor session 1 source interface GigabitEthernet1/0/10
monitor session 1 destination interface GigabitEthernet1/0/20

After connecting the analyzer to Gi1/0/20, users on that switchport report they can no longer reach the network. What is the cause of the connectivity loss?

Accepted Answer

A SPAN destination port only transmits copied traffic and disables normal switching, dropping any traffic sent by devices connected to it unless ingress forwarding is enabled.

Answer

The source and destination interfaces must be in the same VLAN for a local SPAN session to forward user traffic.

Answer

Local SPAN sessions require an RSPAN VLAN, and without one the destination port is placed in an err-disabled state.

Answer

The destination port must be configured as a trunk; as an access port it blocks all non-SPAN traffic.