You can use the Switched Port Analyzer (SPAN) utility to perform detailed troubleshooting
or to take a sample of traffic from a particular application host for proactive
monitoring and analysis.
SPAN copies traffic from one or more ports, VLANs, or endpoint groups (EPGs) and sends
the copied traffic to one or more destinations for analysis by a network analyzer. The
process is nondisruptive to any connected devices and is facilitated in the hardware,
which prevents any unnecessary CPU load.
You can configure SPAN sessions to monitor traffic received by the source (ingress
traffic), traffic transmitted from the source (egress traffic), or both. By default,
SPAN monitors all traffic, but you can configure filters to monitor only selected
You can configure SPAN on a tenant or on a switch. When configured on a switch, you can
configure SPAN as a fabric policy or an access policy.
APIC supports the encapsulated remote extension of SPAN (ERSPAN).
APIC traffic monitoring policies can SPAN policies at the appropriate places to track
members of each application group and where they are connected. If any member moves,
APIC automatically pushes the policy to the new leaf switch. For example, when an
endpoint VMotions to a new leaf switch, the SPAN configuration automatically
Refer to the Cisco APIC Troubleshooting
Guide for detailed information about the configuration, use, and limitations of