14.4 Switched Port Analyzer (SPAN, RSPAN, ERSPAN) & IP SLA Object Tracking
Key Takeaways
- Local SPAN mirrors traffic within a single switch chassis from source ports, VLANs (VSPAN), or Port-Channels (ingress 'rx', egress 'tx', or 'both') to a dedicated destination analyzer port, which disables standard Layer 2/3 forwarding, STP, CDP, and LLDP while monitoring.
- Remote SPAN (RSPAN) transports mirrored traffic across intermediate Layer 2 switch trunks using a dedicated RSPAN VLAN where MAC address learning is explicitly disabled on all switches to ensure flooded delivery to the destination analyzer port.
- Encapsulated Remote SPAN (ERSPAN Types II and III) encapsulates mirrored frames in GRE (IP Protocol 47, GRE Protocol 0x88BE for Type II, 0x22EB for Type III) to route packet captures across Layer 3 routed networks with session IDs and high-precision timestamps.
- IP Service Level Agreements (IP SLA) inject active synthetic traffic (ICMP Echo, UDP Jitter with IP SLA Responder, HTTP, DNS) to measure latency, jitter, packet loss, and application responsiveness.
- Enhanced Object Tracking (EOT) links IP SLA probe states and interface health to control plane policies, triggering deterministic failover in Static Routes ('ip route ... track'), First Hop Redundancy Protocols (HSRP/VRRP priority decrements), and Policy-Based Routing ('set ip next-hop verify-availability').
14.4 Switched Port Analyzer (SPAN, RSPAN, ERSPAN) & IP SLA Object Tracking
Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 4.3 requires candidates to configure SPAN, RSPAN, and ERSPAN, and topic 4.4 requires candidates to configure and verify IP SLA. Enhanced Object Tracking is not a named leaf but is the mechanism that makes an IP SLA probe actionable (EOT). Candidates must master the constraints of Local SPAN source and destination sessions, RSPAN VLAN flooding mechanics, ERSPAN GRE encapsulation (Protocol 47 /
0x88BE), IP SLA probe operation types (ICMP Echo, UDP Jitter with Responder, HTTP, DNS), and EOT integration with static routes, FHRP, and Policy-Based Routing.
Modern enterprise network operations demand two complementary troubleshooting and telemetry capabilities: passive non-intrusive packet analysis (via SPAN technologies) and active synthetic performance probing (via IP SLA paired with Enhanced Object Tracking). While SPAN provides raw bit-level visibility into forwarded frames, IP SLA proactively benchmarks network health and triggers automated control-plane failovers before end-user outages manifest.
1. Switched Port Analyzer (SPAN) Comparison: Local, RSPAN & ERSPAN
Switched Port Analyzer (SPAN) mirrors internal switch traffic from designated source ports or VLANs to an external analysis device (such as a Wireshark packet analyzer, Intrusion Detection System [IDS], or Network Packet Broker) without disrupting live production data flows.
+-----------------------------------------------------------------------------------+
| SPAN TECHNOLOGY EVOLUTION MATRIX |
+-----------------------------------------------------------------------------------+
| Attribute Local SPAN Remote SPAN (RSPAN) ERSPAN (Type II/III) |
| --------------------- ------------------ ------------------- -------------------- |
| Scope Single Switch Layer 2 Switched LAN Layer 3 Routed IP Net |
| Transport Method Internal ASICs Dedicated RSPAN VLAN GRE Tunnel (IP Proto 47)|
| Intermediate Network None Trunk Links (802.1Q) Any IP/MPLS Network |
| MAC Learning on Flow Normal DISABLED on RSPAN Normal IP Routing |
| GRE Protocol Type N/A N/A 0x88BE (II) / 0x22EB (III)|
| Timestamping Precision N/A N/A Sub-microsecond / PTP |
+-----------------------------------------------------------------------------------+
+-----------------------------------------------------------------------------------+
| SPAN TOPOLOGY ARCHITECTURES |
+-----------------------------------------------------------------------------------+
| 1. LOCAL SPAN (Single Switch): |
| [ Source Port Gi0/1 ] ---\ (Internal ASIC Mirroring) |
| [ Source VLAN 10 ] ---> [ Local Switch ] ===> [ Dest Port Gi0/24: Wireshark]|
| |
| 2. REMOTE SPAN (RSPAN - Layer 2 Domain): |
| [ Switch A: Src Gi0/1 ] ===> [ Trunk (VLAN 900) ] ===> [ Switch B: Dest Gi0/24]|
| (Mirrored into RSPAN VLAN 900; MAC learning DISABLED; Floods to Switch B) |
| |
| 3. ENCAPSULATED REMOTE SPAN (ERSPAN - Layer 3 Domain): |
| [ Switch A: Src Gi0/1 ] ===> [ Layer 3 Core / WAN ] ===> [ Switch C / Analyzer]|
| (Mirrored frame encapsulated in GRE + ERSPAN Header -> Routed via IP Unicast) |
+-----------------------------------------------------------------------------------+
2. Local SPAN & Remote SPAN (RSPAN) Mechanics
Local SPAN Session Rules & Destination Port Constraints
In a Local SPAN session, source interfaces and destination monitor ports reside on the same physical switch:
- Source Traffic Direction: Can monitor ingress (
rx), egress (tx), or bidirectional (both- default) traffic. - Source Types: Physical interfaces, EtherChannels (Port-Channels), or entire VLANs (VSPAN). If a VLAN is specified as a SPAN source, all active interfaces in that VLAN are monitored.
- Critical Destination Port Rules:
- The destination port cannot be a source port and cannot participate in another SPAN session.
- While the SPAN session is active, the destination port does NOT participate in Spanning Tree Protocol (STP), CDP, VTP, DTP, LLDP, or standard Layer 2/3 forwarding.
- The destination port drops all incoming packets from the connected analyzer unless explicitly configured with
ingressforwarding (monitor session <id> destination interface <int> ingress ...). - The destination port cannot be an EtherChannel member port.
Remote SPAN (RSPAN) & MAC Learning Deactivation
Remote SPAN (RSPAN) overcomes physical location boundaries by allowing source ports on one switch to mirror traffic across an 802.1Q trunk network to a destination port on another switch:
- Administrators configure a dedicated RSPAN VLAN (
vlan 900,remote-span) on all switches in the Layer 2 path. - When traffic on the source switch matches the SPAN session, the switch injects the mirrored frame into the RSPAN VLAN with an 802.1Q header.
- CRITICAL ARCHITECTURAL MECHANISM: Within an RSPAN VLAN, MAC address learning is completely disabled on all switches. Because MAC addresses are never learned in the CAM table for this VLAN, the switches treat every frame as an unknown unicast flood, forcing the mirrored frames to be flooded out all trunk ports carrying the RSPAN VLAN until they reach the destination switch and egress the monitor port.
- Pruning Best Practice: Because RSPAN frames flood across all trunk links, the RSPAN VLAN should be manually pruned from trunks that do not lead to the destination analyzer switch (
switchport trunk allowed vlan remove <rspan-vlan>).
3. Encapsulated Remote SPAN (ERSPAN Type II vs Type III)
When packet analysis must traverse Layer 3 routing boundaries, WANs, or SD-Access fabric overlays, Encapsulated Remote SPAN (ERSPAN) encapsulates mirrored Ethernet frames into routable Generic Routing Encapsulation (GRE) IP packets.
+-----------------------------------------------------------------------------------+
| ERSPAN PACKET ENCAPSULATION |
+-----------------------------------------------------------------------------------+
| 0 1 2 3 |
| 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
|| Standard IPv4 / IPv6 Header (IP Protocol 47 = GRE) | Outer IP Header |
|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
|| Flags & Version (0x1000) | Protocol Type (0x88BE / 0x22EB)| GRE Header |
|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
|| Ver | VLAN ID (12 bits) | COS | En |T| Session ID (10b) | ERSPAN Header |
|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ (8 or 12 Bytes) |
|| Timestamp (32 bits) / Optional Platform-Specific Sub-Header | |
|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
|| | |
|| Original Mirrored Layer 2 Ethernet Frame (Complete Payload) | Original Frame |
|| | |
|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
+-----------------------------------------------------------------------------------+
ERSPAN Protocol Identifiers & Headers
- Outer IP Transport: Standard IPv4 or IPv6 unicast packet with IP Protocol 47 (GRE).
- GRE Protocol Type Field:
0x88BE: Identifies ERSPAN Type II.0x22EB: Identifies ERSPAN Type III.
- ERSPAN Type II Header (8 Bytes): Contains a 10-bit Session ID (1 to 1023), 12-bit VLAN ID, Class of Service (CoS), direction flag, and 32-bit timestamp.
- ERSPAN Type III Header (12 or 20 Bytes): Enhances Type II by adding sub-microsecond PTP timestamps, platform-specific hardware metadata, switch domain identifiers, and packet drop indicators.
- Destination Endpoints: The destination can be a remote Cisco switch (which decapsulates the GRE header and forwards the raw frame to a local port) or an ERSPAN-aware software analyzer (such as Wireshark or an IDS) that decapsulates the GRE wrapper directly in software.
4. IP Service Level Agreements (IP SLA) Architecture & Probes
IP Service Level Agreements (IP SLA) is an active diagnostic mechanism embedded in Cisco IOS-XE that continuously measures network performance by generating synthetic traffic across the network.
+-----------------------------------------------------------------------------------+
| IP SLA PROBE OPERATION TYPES |
+-----------------------------------------------------------------------------------+
| Operation Type Transport / Target Key Performance Metrics Measured |
| ----------------- ------------------------ ----------------------------------- |
| ICMP Echo ICMP Type 8 (IP Target) Round-trip delay (RTT), Packet Loss |
| UDP Jitter UDP Port (Requires IP One-way latency, Round-trip delay, |
| SLA Responder on target) Inter-packet Jitter, Loss, MOS Score |
| HTTP TCP 80 / 443 (Web Server) DNS lookup time, TCP connect time, |
| HTTP transaction & response duration |
| DNS UDP 53 (DNS Server) DNS query resolution response time |
| TCP Connect TCP Port (Any TCP Target) 3-Way handshake connection latency |
+-----------------------------------------------------------------------------------+
The IP SLA Responder
While basic probes (such as ICMP Echo or HTTP) require no special software on the target, advanced operations like UDP Jitter require the destination Cisco device to run the IP SLA Responder (ip sla responder).
- When an IP SLA packet arrives at the responder, the responder intercepts the packet at the hardware layer and timestamps the exact moment of arrival ($T_2$) and departure ($T_3$).
- This eliminates internal processing delay and CPU queuing on the target device from the calculation, enabling precise measurement of one-way latency (source-to-destination vs destination-to-source) and inter-packet jitter essential for VoIP (Voice over IP) and video metrics.
5. Enhanced Object Tracking (EOT) & Control-Plane Integration
Enhanced Object Tracking (EOT) decouples tracking mechanisms from client processes. An object tracks an underlying operational parameter (an interface state, a route in the RIB, or an IP SLA probe state) and reports a binary state (UP or DOWN) or a metric value to subscriber protocols.
+-----------------------------------------------------------------------------------+
| ENHANCED OBJECT TRACKING (EOT) BINDINGS |
+-----------------------------------------------------------------------------------+
| |
| +-----------------------------------+ |
| | TRACK OBJECT (e.g., Track 10) | |
| | - Interface Line-Protocol | |
| | - IP Route Reachability / Metric | |
| | - IP SLA Probe State / Latency | |
| | - Boolean / Threshold Lists | |
| +-----------------------------------+ |
| | |
| +---------------------+---------------------+ |
| | | |
| v v |
| +---------------------------------+ +---------------------------------+ |
| | STATIC ROUTE WITH TRACKING | | FIRST HOP REDUNDANCY (FHRP) | |
| | 'ip route 0.0.0.0 0.0.0.0 | | 'standby 1 track 10 decrement 30| |
| | 203.0.113.1 track 10' | | - If Track 10 FAILS -> Priority | |
| | - If Track 10 FAILS -> Static | | drops from 110 to 80. | |
| | route purged from RIB; floats | | - Standby router preempts and | |
| | to backup ISP gateway. | | becomes Active gateway! | |
| +---------------------------------+ +---------------------------------+ |
| | |
| v |
| +-------------------------------------+ |
| | POLICY-BASED ROUTING (PBR) | |
| | 'set ip next-hop verify-availability| |
| | 203.0.113.1 1 track 10' | |
| | - If Track 10 UP -> Force via PBR | |
| | - If Track 10 DOWN -> Fallback to | |
| | standard routing table. | |
| +-------------------------------------+ |
+-----------------------------------------------------------------------------------+
Track Object Types & Logical Combinations
- Interface State Tracking:
track 1 interface GigabitEthernet0/0/0 line-protocol - IP Route Reachability:
track 2 ip route 0.0.0.0/0 reachability(Validates prefix exists in RIB). - IP SLA Reachability / State:
track 10 ip sla 100 reachability(Monitors IP SLA return code). - Boolean List Tracking: Evaluates multiple objects using Boolean logic:
track 20 list boolean and(Object is UP only if ALL member objects are UP).track 20 list boolean or(Object is UP if ANY member object is UP).
- Weighted Threshold Tracking: Assigns weights to member objects; the list transitions DOWN when total active weight falls below a configured threshold (
track 30 list threshold weight).
6. Cisco IOS-XE Configuration & Verification CLI
1. SPAN, RSPAN, and ERSPAN Configuration
! --- 1. LOCAL SPAN CONFIGURATION ---
monitor session 1 source interface GigabitEthernet0/0/1 both
monitor session 1 source vlan 10 , 20 rx
monitor session 1 destination interface GigabitEthernet0/0/24
! --- 2. REMOTE SPAN (RSPAN) CONFIGURATION ---
! Step A: Define RSPAN VLAN on all switches
vlan 900
name RSPAN_MONITORING_VLAN
remote-span
!
! Step B: Configure Source Switch
monitor session 2 source interface GigabitEthernet0/0/2 both
monitor session 2 destination remote vlan 900
!
! Step C: Configure Destination Switch
monitor session 2 source remote vlan 900
monitor session 2 destination interface GigabitEthernet0/0/48
! --- 3. ENCAPSULATED REMOTE SPAN (ERSPAN) CONFIGURATION ---
! Source Session on Switch A (Encapsulates in GRE)
monitor session 10 type erspan-source
source interface GigabitEthernet0/0/1 both
destination
erspan-id 100
ip address 192.168.200.10
origin ip address 192.168.100.1
! Destination Session on Switch B (Decapsulates GRE to port)
monitor session 10 type erspan-destination
destination interface GigabitEthernet0/0/24
source
erspan-id 100
ip address 192.168.200.10
2. IP SLA and Enhanced Object Tracking Configuration
! Step 1: Configure IP SLA ICMP Echo Probe to ISP Gateway
ip sla 100
icmp-echo 203.0.113.1 source-interface GigabitEthernet0/0/0
threshold 200
timeout 1000
frequency 5
! Step 2: Schedule IP SLA Probe
ip sla schedule 100 life forever start-time now
! Step 3: Bind IP SLA Probe to Track Object with Hysteresis Delay
track 10 ip sla 100 reachability
delay down 10 up 15
! Step 4: Bind Track Object to Default Static Route
ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 10
! Backup Floating Static Route (Administrative Distance 200)
ip route 0.0.0.0 0.0.0.0 198.51.100.1 200
3. Verification CLI Output
Router-1# show monitor session 1
Session 1
---------
Type : Local Session
Source Ports :
Both : Gi0/0/1
Source VLANs :
RX Only : 10,20
Destination Ports : Gi0/0/24
Encapsulation : Native
Ingress : Disabled
Router-1# show ip sla summary
IPSLAs Latest Operation Summary
Codes: * active, ^ inactive, ~ pending
ID Type Destination Stats Return Last
(Latency) Code Run
------------------------------------------------------------------------------
*100 icmp-echo 203.0.113.1 RTT=4ms OK 2 seconds ago
Router-1# show track 10
Track 10
IP SLA 100 reachability
Reachability is Up
2 state changes, last state change 00:45:12
Latest sub-oper to return: OK
Latest RTT (millisecs) 4
Delay up 15 secs, down 10 secs
Tracked by:
Static IP Route 0.0.0.0/0
HSRP GigabitEthernet0/0/1.10 group 10
A network engineer configures a Remote SPAN (RSPAN) session across multiple Layer 2 switches to monitor traffic from an access switch to a centralized analyzer connected to a core switch. How do intermediate switches in the Layer 2 path ensure that the mirrored traffic reaches the destination switch?
An engineer inspects packet captures of an Encapsulated Remote SPAN (ERSPAN) session traversing an enterprise WAN core. Which transport protocol and protocol type field in the outer header identify the mirrored traffic as an ERSPAN Type II stream?
A network architect designs a dual-homed branch office where the primary default route points to an ISP gateway via a static route. The architect requires that if the ISP gateway loses upstream Internet reachability (while the physical interface remains up), the static route is immediately removed from the routing table so traffic fails over to a backup cellular link. Which solution accomplishes this?
A voice engineer needs to measure bidirectional jitter, one-way latency, and packet loss across an MPLS WAN link to evaluate voice quality (MOS score) between two Cisco routers. Which IP SLA operation should be deployed, and what prerequisite is required on the target router?