Overview
This book provides configuration and troubleshooting procedures for network monitoring features such as local SPAN, ERSPAN, and SPAN to file. It explains how to capture traffic, analyze dropped packets, and manage file synchronization to facilitate comprehensive network analysis and redundancy.
Preface
This cumulative guide provides a single, continuously updated version that includes all the latest IOS XR features and release updates. It simplifies your experience by letting you bookmark one link and access the complete guide, instead of navigating through multiple release-specific versions.
Using YANG Data Models
This chapter provides information about the YANG data models for traffic mirroring features.
Getting Started with Traffic Mirroring
This chapter introduces traffic mirroring, key concepts, traffic mirroring types, and key terminology. Users can learn about how traffic mirroring works to enable network analysis without impacting live traffic.
ACL-based traffic mirroring
This chapter provides configuration procedures for ACL-based traffic mirroring to selectively monitor IPv4, IPv6, and MPLS traffic. These techniques enhance security and optimize resource usage by focusing on specific data flows defined by addresses, protocols, or port numbers.
Local SPAN
Learn how to set up and manage local SPAN to mirror traffic for network analysis on a single router. This chapter covers general configuration, filtering with ACLs, rate limiting, and provides essential guidelines and restrictions for implementation.
ERSPAN
This chapter, Encapsulated Remote Switched Port Analyzer (ERSPAN), explains its function in mirroring network traffic via GRE tunnels for analysis. It covers features like higher payload support, GRE IPv6 and MPLS integration, partial packet capture, rate limiting, DSCP-based traffic classification, and multi-session monitoring with ACLs.
SPAN to file
This chapter explains a traffic monitoring feature that captures traffic to PCAP files for later analysis. It details capabilities such as partial packet capture, transmit (Tx) direction mirroring, continuous Always-On capture with periodic writes, and Unique Capture to reduce redundant data.
Mirror forward-drop packets
This chapter captures and analyzes packets dropped by a router during forwarding. It helps network administrators understand blocked traffic, identify security threats, troubleshoot issues, and optimize performance by mirroring these packets to a specified destination.
Mirror buffer drop packets
This chapter details the mirror buffer drop packets feature, which captures and mirrors packets dropped by a router's Traffic Management (TM) buffer due to overflow, specifically exact or statistical metering. It enables analysis of these dropped packets, offering benefits like data preservation, control plane stability, and failover assurance.
File Mirroring
This chapter details the File mirroring feature, which automatically copies files and directories from an active Route Processor (RP) to a standby RP or RSP. It eliminates manual intervention for file synchronization, ensuring redundancy.
How to troubleshoot traffic mirroring
This chapter covers how to troubleshoot traffic mirroring issues. It outlines a systematic approach starting with the show monitor-session status command to diagnose configuration errors and operational problems. The document details various session and source interface status messages, their explanations, and recommended actions.