Catalyst 6500 Series Switches SPAN Captures for CPU-Bound Traffic

Introduction

This document describes how to use the Switch Port Analyzer (SPAN) feature as RP-Inband SPAN in order to capture packets on the path between the Switch Processor (SP) CPU and the Router Processor (RP) CPU on a Cisco Catalyst 6500 Series switch that runs Supervisor Engine 720.

Although all packets on this path do not reach the CPU, this process provides a good sample to analyze in cases of high-CPU utilization due to traffic that is punted to the CPU.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on Cisco Catalyst 6500 Series switches that run Supervisor Engine 720.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Capture Packets

Determine the Cisco IOS^® version that runs on your switch, and use the appropriate commands:

Cisco IOS Release 12.2(18)SXF

6500#monitor session 1 source interface <mod/port> 
!Use any dummy interface that is administratively shut down.

6500#monitor session 1 destination interface <mod/port> 
! interface with PC running wireshark attached 

6500#remote login switch

6500-sp#test monitor add 1 rp-inband tx

Cisco IOS Releases 12.2(33)SXH and Later

6500(config)# monitor session 1 type local 

6500(config-mon-local)# source cpu rp tx 

6500(config-mon-local)# destination interface <mod/port>
! interface with PC running wireshark attached

6500(config-mon-local)# no shut

This configuration mirrors traffic on the SP-RP inband path, and diverts it to the destination interface. Connect a PC on the destination interface, and start the sniffer application (Wireshark, for example) in order to capture traffic received on the Network Interface Card (NIC).