Traffic Mirroring Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

PDF

Partial packet capture for ERSPAN

Updated: March 2, 2026

Want to summarize with AI?

Log in

Overview

This section explains how partial packet capture allows ERSPAN to capture only a portion of incoming packets rather than the entire payload.

Partial packet capture is a traffic mirroring mechanism that:

  • allows ERSPAN to capture only a portion of incoming packets (Rx), rather than capturing the entire packet, and

  • allows you to focus on specific header information without needing the entire payload

Benefits of partial packet capture

These are the benefits of capturing partial packets for ERSPAN:

  • With less data to process, network analysis and troubleshooting can be faster, allowing quicker identification of issues.

  • By capturing only part of the packet, you reduce the amount of data that needs to be mirrored for monitoring. This can alleviate bandwidth consumption and memory requirements.

Configuration guidelines for partial packet capture

These are the guidelines for configuring partial packet capture:

  • Enables the new ERSPAN GREv4 and GREv6 truncation configuration per device.

  • Configures truncation settings specifically on monitor sessions. Packets received from all sources are truncated if truncation is enabled on a monitor session.

  • By default, the whole packet is mirrored without the mirror first number (truncation size) configuration.

  • The router supports these maximum punting capacities for ERSPAN with MPLS functionality on bundle or physical source interfaces with GREv4 and partial packet:

    • Cisco Silicon One Q200 ASIC-based systems — 343 bytes

    • Cisco Silicon One P100 ASIC-based systems — 160 bytes

    • Cisco Silicon One A100 ASIC-based systems — 144 bytes

    • Cisco Silicon One K100 ASIC-based systems — 160 bytes

  • Displays an informative system message, ios-msg, to warn the user when the configured truncation size exceeds 343 bytes. Example message: 
    ERSPAN only supports a 343-byte truncation size. The monitor session with session ID <id> will be set to 343 bytes only.

Restrictions for partial packet capture

These restrictions apply to partial packet capture:

  • Partial packet capture or packet trucation is per monitor session.

  • Truncation per interface is not supported.

  • Packet truncation applies for SPAN to file and ERSPAN interfaces only. If you change the destination to local SPAN, then an ios_msg is displayed as a warning. The entire packet is mirrored after this message is displayed.

    ios_msg example: 
    The Partial Packet Capture feature is not supported by Local SPAN. The entire
Packet will be mirrored.

Configure partial packet capture for ERSPAN

Use this procedure to configure partial packet capturing for ERSPAN on incoming (Rx) traffic.

Procedure

1.

Create an ERSPAN monitor session for mirroring the packets to the tunnel-ip 30 with truncation enabled, and use the mirror first option to enable partial packet capturing.

Example:

monitor-session mon1 ethernet
 destination interface tunnel-ip 30
 mirror first  343
!

The mon1 monitoring session sets the size of truncation packets for an ERSPAN session to 343.
2.

Attach the session to interfaces and specify the direction as rx-only.

Example:

interface HundredGigE0/0/0/12
  monitor-session mon1 ethernet direction rx-only
!
3.

Verify the configuration by using the show monitor-session status internal command.

Example:

Router#show monitor-session mon1 status internal
Fri Apr 12 18:50:45.006 UTC
Information from SPAN Manager and MA on all nodes:
Packet truncation size: 343B
Monitor-session mon1 (ID 0x00000001) (Ethernet)
SPAN Mgr: Destination interface Tunnel-IP 20 (0x0f000250)
          Last error: Success
 
Information from SPAN EA on all nodes:
Monitor-session 0x00000001 (Ethernet)
0/RP0/CPU0: Name 'mon1', destination interface Tunnel-IP 20 (0x0f000250)
Platform, 0/RP0/CPU0:
 
  Monitor Session Packets: 142462
 
  Monitor Session Bytes: 7653237