SPAN - how to easy configure SPAN on Cisco switch and port monitor on HP

SPAN – Switched Port Analyzer it’s a great tool when you need to troubleshoot something in your network. It’s called port mirroring or port monitoring. It’s allows you to select one or more source interface (also you can copy all Vlans) onto one or mode destinations ports. I always connect on destination port laptop with packet sniffer like Wireshark or TCPDump. 

To capture network traffic from interface G0/1 to interface G0/2 we need to set up : 

CISCO_LAB_3750(config)#monitor session 1 source interface gigabitEthernet 0/1

CISCO_LAB_3750(config)#monitor session 1 destination interface gigabitEthernet 0/2

We need to specify which traffic direction we want to capture :

CISCO_LAB_3750(config)#monitor session 1 source interface gigabitEthernet 0/1 ?

  ,     Specify another range of interfaces

  -     Specify a range of interfaces

  both  Monitor received and transmitted traffic
  rx    Monitor received traffic only
  tx    Monitor transmitted traffic only
  <cr>

To verify the setup of SPAN session:

CISCO_LAB_3750#   show monitor session 1
Session 1
---------
Type                   : Local Session
Source Ports           :
Both               : Gi1/0/5
Destination Ports      : Gi1/0/6
Encapsulation      : Native
Ingress      : Disabled

CISCO_LAB_3750#   show monitor session 1 detail
Session 1
---------
Type                   : Local Session
Description            : -
Source Ports           :
    RX Only            : None
    TX Only            : None
    Both               : Gi1/0/5
Source VLANs           :
    RX Only            : None
    TX Only            : None
    Both               : None
Source RSPAN VLAN      : None
Destination Ports      : Gi1/0/6
    Encapsulation      : Native
    Ingress      : Disabled
Filter VLANs           : None
Dest RSPAN VLAN        : None

<edit> I had to configure span on HP. In this case we need to use command :

#source interface
interface 1
monitor
exit

#destination interface
mirror-port 2

Bellow there are few information from cisco.com :

SPAN Terminology

• Ingress traffic—Traffic that enters the switch.
  
• Egress traffic—Traffic that leaves the switch.
  
• Source (SPAN) port —A port that is monitored with use of the SPAN feature.
  
• Source (SPAN) VLAN —A VLAN whose traffic is monitored with use of the SPAN feature.
  
• Destination (SPAN) port —A port that monitors source ports, usually where a network analyzer is connected.
  
• Reflector Port —A port that copies packets onto an RSPAN VLAN.
  
• Monitor port—A monitor port is also a destination SPAN port in Catalyst 2900XL/3500XL/2950 terminology.
  

• Local SPAN—The SPAN feature is local when the monitored ports are all located on the same switch as the destination port. This feature is in contrast to Remote SPAN (RSPAN), which this list also defines.
  
• Remote SPAN (RSPAN)—Some source ports are not located on the same switch as the destination port. RSPAN is an advanced feature that requires a special VLAN to carry the traffic that is monitored by SPAN between switches. RSPAN is not supported on all switches. Check the respective release notes or configuration guide to see if you can use RSPAN on the switch that you deploy.
  
• Port-based SPAN (PSPAN)—The user specifies one or several source ports on the switch and one destination port.
  
• VLAN-based SPAN (VSPAN)—On a particular switch, the user can choose to monitor all the ports that belong to a particular VLAN in a single command.
  
• ESPAN—This means enhanced SPAN version. This term has been used several times during the evolution of the SPAN in order to name additional features. Therefore, the term is not very clear. Use of this term is avoided in this document.
  
• Administrative source—A list of source ports or VLANs that have been configured to be monitored.
  
• Operational source—A list of ports that are effectively monitored. This list of ports can be different from the administrative source. For example, a port that is in shutdown mode can appear in the administrative source, but is not effectively monitored.