SPAN Port Traffic
If you are capturing a subnet from a SPAN port, you must determine if the SPAN port is sending you only that subnet or other traffic.
If you are receiving just that subnet, then select Specific
Ports on All Hosts to capture specific ports. For example,
to capture all port 80 and 443 traffic on all hosts, select Specific
Ports on All Hosts and enter ports 80 and 443.
If your SPAN port is mirroring additional traffic, then select Specific Host-Port Combinations. For the hosts, use CIDR syntax to match the subnet. In our port 80 and 443 example, if you wanted all the traffic for network 1.2.3.0 netmask 255.255.255.0, then specify the following Specific Host-Port Combinations:
- Host
- Port
- 1.2.3.0/24
- 80
- 1.2.3.0/24
- 443