WEBVTT

1
00:00.000 --> 00:03.920
To begin our discussion regarding switch port analyzer or span, let's also just

2
00:03.920 --> 00:04.640
remind ourselves

3
00:04.640 --> 00:08.480
that what we're doing is we're doing port mirroring. For example, we're taking

4
00:08.480 --> 00:09.520
traffic that might be

5
00:09.520 --> 00:13.780
going in or out of a certain port like gig zero slash one and then replicating

6
00:13.780 --> 00:15.120
all those packets

7
00:15.120 --> 00:18.590
over to another port let's say three slash three here and on that port that's

8
00:18.590 --> 00:19.840
where we have some

9
00:19.840 --> 00:24.400
software like a wire shark application or a protocol capture software that can

10
00:24.400 --> 00:25.280
collect that data

11
00:25.280 --> 00:28.860
then represent it to us in the graphical user interface or if it's command line

12
00:28.860 --> 00:29.600
at the command

13
00:29.600 --> 00:34.170
line interface here at the protocol analyzer and the source could be either a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.600 --> 00:34.170
line interface here at the protocol analyzer and the source could be either a

14
00:34.170 --> 00:35.360
port or a set of ports

15
00:35.360 --> 00:39.980
or we could say we want to collect all the packets that are seen on a given V

16
00:39.980 --> 00:41.280
LAN and then mirror or

17
00:41.280 --> 00:45.470
copy them over to a destination port of our choice. So the three main options

18
00:45.470 --> 00:47.040
with switch port analyzer

19
00:47.040 --> 00:52.520
span is the traditional span and what that means is we're doing the capture and

20
00:52.520 --> 00:53.600
redirection of

21
00:53.600 --> 00:58.390
those packets on the same switch meaning the source of those packets and the

22
00:58.390 --> 01:00.080
destination of those packets
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:58.390 --> 01:00.080
destination of those packets

23
01:00.080 --> 01:03.890
are all within one switch and what we just drew here is an example of that

24
01:03.890 --> 01:05.520
where we are capturing

25
01:05.520 --> 01:10.100
all the traffic that's going in or out of or both of gig zero slash one here

26
01:10.100 --> 01:11.120
and then replicating

27
01:11.120 --> 01:14.290
it or mirroring it over to port three slash three and because it's all in one

28
01:14.290 --> 01:15.120
switch that means

29
01:15.120 --> 01:18.020
example of span. So let's clean it up a little bit and let's take a look at

30
01:18.020 --> 01:18.720
another option.

31
01:18.720 --> 01:24.720
Another option we have in the world of a switch port analyzer is called RSPAN

32
01:24.720 --> 01:26.160
and that R is for

33
01:26.160 --> 01:30.350
remote and what R span means is instead of using one switch we're going to have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:26.160 --> 01:30.350
remote and what R span means is instead of using one switch we're going to have

34
01:30.350 --> 01:31.760
two or more switches

35
01:31.760 --> 01:36.440
involved in the capturing and the delivering of that data. So for example here

36
01:36.440 --> 01:37.040
let's go ahead and

37
01:37.040 --> 01:40.840
use switch two as the source. Let's imagine we want to capture data that's

38
01:40.840 --> 01:42.320
going in or out of or in

39
01:42.320 --> 01:47.400
and out of gig zero slash one and we want to replicate that over so that we

40
01:47.400 --> 01:48.560
have a port let's say here

41
01:48.560 --> 01:53.600
three slash two on switch one a different switch where our protocol analyzer is

42
01:53.600 --> 01:54.480
. So if we want to

43
01:54.480 --> 01:57.760
click the data that's happening here and mirror it over so we can deliver it

44
01:57.760 --> 01:58.720
shared a port three

45
01:58.720 --> 02:03.050
slash two here's the method that Cisco uses with RSPAN to do that. We're going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:58.720 --> 02:03.050
slash two here's the method that Cisco uses with RSPAN to do that. We're going

46
02:03.050 --> 02:04.720
to go ahead and on switch

47
02:04.720 --> 02:08.600
two we'll go ahead and we'll collect that data and let's say for the example we

48
02:08.600 --> 02:09.360
want to collect

49
02:09.360 --> 02:13.490
traffic in and out of gig zero slash one and then what we'll do is we'll go

50
02:13.490 --> 02:14.640
ahead and we'll go

51
02:14.640 --> 02:18.930
ahead and copy that data from that port in and out to a specific VLAN that's

52
02:18.930 --> 02:19.760
set up just for the

53
02:19.760 --> 02:24.270
purposes of RSPAN. So we'll send it over to our RSPAN VLAN. So let's imagine we

54
02:24.270 --> 02:26.480
create VLAN 999

55
02:26.480 --> 02:31.030
and we specify that it's our RSPAN VLAN switch two's job is to collect data
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:26.480 --> 02:31.030
and we specify that it's our RSPAN VLAN switch two's job is to collect data

56
02:31.030 --> 02:32.640
from that port and then

57
02:32.640 --> 02:37.520
replicate it over to RSPAN VLAN 999. So assuming this is a trunk right here and

58
02:37.520 --> 02:38.400
assuming that trunk

59
02:38.400 --> 02:44.000
permits the traffic from VLAN 999 that traffic on VLAN 999 will be seen over

60
02:44.000 --> 02:45.440
here at switch one.

61
02:45.440 --> 02:48.570
So here on switch one we tell it to go ahead and collect the data but instead

62
02:48.570 --> 02:49.040
of collecting it

63
02:49.040 --> 02:53.510
for example from a specific port we'll tell it to go ahead and collect the data

64
02:53.510 --> 02:54.720
from VLAN 999

65
02:54.720 --> 02:58.320
and then right here on gig three two if that's where our protocol analyzer is

66
02:58.320 --> 02:58.720
we'll then go

67
02:58.720 --> 03:03.300
ahead and say go ahead and send that data you collect it from VLAN 999 over to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:58.720 --> 03:03.300
ahead and say go ahead and send that data you collect it from VLAN 999 over to

68
03:03.300 --> 03:04.240
port gig three

69
03:04.240 --> 03:07.930
slash two. I'm going to kind of think of this RSPAN VLAN here like a taxi

70
03:07.930 --> 03:10.000
service. So the initial

71
03:10.000 --> 03:13.180
switch right here is copying the data over to that taxi service like a bus and

72
03:13.180 --> 03:13.840
that's being

73
03:13.840 --> 03:16.870
then delivered over to switch one who's taking it off the bus and then

74
03:16.870 --> 03:17.920
delivering it over to port

75
03:17.920 --> 03:21.440
three slash two. So with RSPAN what we're doing is we're using two or more

76
03:21.440 --> 03:22.400
switches and then we're

77
03:22.400 --> 03:27.430
using a dedicated VLAN for the carrying or the transportation of that span

78
03:27.430 --> 03:28.720
traffic. In this case

79
03:28.720 --> 03:33.190
from switch two over to switch one. So our third option regarding switch port
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:28.720 --> 03:33.190
from switch two over to switch one. So our third option regarding switch port

80
03:33.190 --> 03:34.560
analyzer is called

81
03:34.560 --> 03:42.310
ERSPAN and the ERSPAN stands for encapsulated RSPAN and the way the ERSPAN

82
03:42.310 --> 03:43.600
works is pretty clever

83
03:43.600 --> 03:47.460
is simply tunnels the traffic using GRE. Now what do I mean by that? What do I

84
03:47.460 --> 03:48.240
mean by tunneling

85
03:48.240 --> 03:52.150
traffic? Let's imagine once again that we want to collect the data that's going

86
03:52.150 --> 03:53.520
in and out of

87
03:53.520 --> 03:58.350
gig zero slash one here on switch two and let's imagine that this machine right

88
03:58.350 --> 03:59.120
here is going to

89
03:59.120 --> 04:02.260
be the machine where we're running our protocol analyzer and we want this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:59.120 --> 04:02.260
be the machine where we're running our protocol analyzer and we want this

90
04:02.260 --> 04:03.280
machine to receive the

91
04:03.280 --> 04:07.010
packets that are being sent in and out of this interface we have a mirror all

92
04:07.010 --> 04:07.680
the way down to

93
04:07.680 --> 04:10.980
this machine. So to do that on the source switch again this would be switch two

94
04:10.980 --> 04:11.760
here our source

95
04:11.760 --> 04:15.620
switch. We'd tell it we want to capture on gig zero slash one and then

96
04:15.620 --> 04:17.040
regarding where to send

97
04:17.040 --> 04:19.550
it instead of sending it to another port on the local switch and instead of

98
04:19.550 --> 04:20.880
sending it to a VLAN

99
04:20.880 --> 04:24.870
with encapsulated remote span what we do is we actually encapsulate the frames

100
04:24.870 --> 04:25.680
that we see in and

101
04:25.680 --> 04:29.470
out of this gig zero and interface we encapsulate them in GRE and ship them to

102
04:29.470 --> 04:31.040
the destination address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
04:29.470 --> 04:31.040
the destination address

103
04:31.040 --> 04:37.580
where we want to send it. So for the destination it'd be in this case 10.44.0.

104
04:37.580 --> 04:38.800
50 that's the IP address

105
04:38.800 --> 04:42.680
of this computer and the source address would be an address that this switch to

106
04:42.680 --> 04:43.440
as let's say it

107
04:43.440 --> 04:48.710
has a reachable address of 2.2.2.2. So effectively we just have GRE traffic

108
04:48.710 --> 04:50.800
from 2222 going to 1044

109
04:50.800 --> 04:54.880
0.50 and the payload as part of that GRE packet that's being sent would be the

110
04:54.880 --> 04:56.240
frame that was seen here

111
04:56.240 --> 04:59.680
on this gig zero when interface whether it was going in or out of that

112
04:59.680 --> 05:00.880
interface and then hopefully
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:59.680 --> 05:00.880
interface and then hopefully

113
05:00.880 --> 05:04.700
down here we've got a device ready and willing and able to receive that GRE

114
05:04.700 --> 05:05.680
traffic so you can go

115
05:05.680 --> 05:10.000
ahead and analyze it. So that's the concept of ER span or encapsulating that

116
05:10.000 --> 05:11.520
traffic with GRE and

117
05:11.520 --> 05:17.080
GRE is IP protocol 47. So therefore that traffic would show up as protocol 47

118
05:17.080 --> 05:18.800
which again would be

119
05:18.800 --> 05:22.960
GRE traffic and then the payload beyond that would be the original captured

120
05:22.960 --> 05:23.920
traffic here

121
05:23.920 --> 05:28.270
that was either coming in or out of gig zero slash one and now being sent down

122
05:28.270 --> 05:29.040
to this IP

123
05:29.040 --> 05:33.150
address 10.44.0.50 for analysis. So what you and I get to do in this set of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:29.040 --> 05:33.150
address 10.44.0.50 for analysis. So what you and I get to do in this set of

124
05:33.150 --> 05:34.080
videos is we're going to

125
05:34.080 --> 05:38.790
walk through examples of configuring each and every one of these switch port

126
05:38.790 --> 05:39.760
analyzer options

127
05:39.760 --> 05:44.390
starting with span then R span and then ER span. So our first one list here is

128
05:44.390 --> 05:45.440
switch port analyzer

129
05:45.440 --> 05:49.490
with a single switch and that's exactly what you and I get to do in the next

130
05:49.490 --> 05:50.720
video. I'll see you there