SPAN, RSPAN & ERSPAN

Switches don’t let you sniff other people’s traffic — SPAN copies frames from source ports/VLANs (rx, tx or both) to a dedicated monitor port feeding Wireshark or an IDS. Original traffic untouched; the monitor port stops switching. RSPAN: mirrors across switches through a dedicated remote-span VLAN — L2 domain only. ERSPAN: GRE-encapsulated, routable across L3 […]