SPAN

ERSPAN

Destination

Conf t
# interface connected to wireshark
interface e1/1
  switchport monitor

# monitor session
monitor session 1 type erspan-destination
source ip 1.1.1.52 (Loop back of this switch)
destination interface e1/1
erspan-id 1
no shut

# Verification
- show monitor session 1

Source

• Can be configured on multiple source

conf t
monitor erspan origin ip-address 1.1.1.51 [global] (ip address of this router)
monitor session 1 type erspan-source
vrf default
source interface e1/5 - 6 both (interface to capture traffic)
destination ip 1.1.1.52 (ip address of erspan destination configured above)
erspan-id 1
no shut

# Verification
- show monitor session 1

SPAN

monitor session 1
source interface e1/6, e1/15 both
destination interface e1/2
no shut

interface e1/2
switchport monitor