A mirror or SPAN (switch port analyzer) port can be a very useful resource if used in the correct way. SPAN ports are typically found on network switch gear and the feature is used to send a copy of network packets seen on one switch port (or an entire VLAN) to another switch port. A SPAN port is very much like a phone tapping device; users on the network have no idea that their conversations are being listened to.
Benefits
- Two SPAN ports available on most managed switches
- Gain visibility into what is happening on the LAN and WAN
- Access to packet payloads which can be used for application decoding
- Better data for troubleshooting (website names, latency values, file names, etc…)
Limitations
- Groomed data (change timing, add delay)
- Monitoring device may miss packets due to port over-subscription
- Bad packets are dropped and will not be seen on a SPAN port
Once you understand the concept of a SPAN port, the next challenge is where to set them up. The answer to this can depend on what your requirements are. For example, if you want to do deep packet inspection on all traffic going to and from the Internet, you should only SPAN traffic going to and from your firewall and/or proxy servers. For most applications, the network core is an ideal location for a SPAN port. You just need to make sure you don’t overload the SPAN port by trying to monitor too many ports or VLANs.
I often get asked the question, “Will a SPAN port cause any problems on a network?” The most common problem I come across is when the total amount of traffic aggregated from the source ports exceeds the physical limitations of the destination port. This will result in some dropped packets on the destination port. However, this does not cause any switch performance degradation or disruption or traffic flow on the source ports. The only affected port is the destination port, and it drops packets on a first in first out (FIFO) basis once the egress buffer limit is exceeded.
SPAN port features vary among switch vendors. Because of this, the impact SPAN has on switch operation can vary. On the Cisco Catalyst 5500/5000 and 6500/6000 series switches, a packet received on a port is transmitted on the internal switching bus. Every line card in the switch starts storing this packet in its internal buffers. At the same time, the Encoded Address Recognition Logic (EARL) receives the header of the packet and computes a result index that it sends to all the line cards via the result bus. Whether one or several ports eventually transmit the packet has absolutely no influence on the switch operation. Therefore, considering this architecture, the SPAN feature has no impact on the performance.
Setting up a SPAN port is one thing, making sense of the data it provides is another. There are many free and commercial applications that use SPAN ports as a source. At the free end of things, you could use something like Wireshark. It is one of my favorite troubleshooting tools and is ideal for issues associated with a specific host or network port. It does become difficult to use when you are monitoring many ports or VLANs, as it can be easy to get overwhelmed with data. In this case, you may need to look at installing an appliance or application which will extract specific information from the data packets. Most systems which use a SPAN port will have a least 2 network cards: one for management, and one for the SPAN port. The information captured can then be used to troubleshoot application, user, and network issues.
Most switches will give you the option of creating two SPAN ports. While this may be enough for most networks, you may end up with a situation where no SPAN ports are available. In these cases, you could consider a network TAP (test access point). A passive network TAP operates by duplicating data from one port to one or more others. It operates like SPAN except it gives you the advantage of 100% visibility, no dropped packets and no delay. Another way of increasing SPAN ports is to get a dedicated switch to send the SPAN traffic to; this dedicated switch will then give you the option of creating two more SPAN ports from the single SPAN source. Just watch out for any topology changes with a configuration like this.
About Darragh Delaney
