How to troubleshoot traffic mirroring

This chapter covers how to troubleshoot traffic mirroring issues. It outlines a systematic approach starting with the show monitor-session status command to diagnose configuration errors and operational problems. The document details various session and source interface status messages, their explanations, and recommended actions

Troubleshoot traffic mirroring issues

When you encounter any issue with traffic mirroring, begin troubleshooting by checking the output of the show monitor-session status command.

Procedure

Step 1

Use the show monitor-session status command when you encounter any issue with traffic mirroring. This command displays the recorded state of all sessions and source interfaces:

Example:


Monitor-session sess1
<Session status>
================================================================================
Source Interface   Dir  Status
--------------------- ---- ----------------------------------------------------
Gi0/0/0/0       Both <Source interface status>
Gi0/0/0/2       Both <Source interface status>

The <Session status> indicates one of these configuration errors:

Session Status

Explanation

Session is not configured globally

The session does not exist in global configuration. Check show run command output to ensure that a session with a correct name has been configured.

Destination interface <intf> is not configured

The interface that has been configured as the destination does not exist. For example, the destination interface may be configured as a VLAN subinterface, but the VLAN subinterface may not yet be created.

Destination interface <intf> (<down-state>)

The destination interface is not in Up state in the Interface Manager. You can verify the state using the show interfaces command.

Check the configuration to see what might be keeping the interface from coming up. For example, a sub-interface needs to have an appropriate encapsulation configured.

<Source interface status> reports these messages:

Source Interface Status

Explanation

Operational

Everything appears to be working correctly in traffic mirroring PI. Please follow up with the platform teams in the first instance if mirroring is not operating as expected.

Not operational (Session is not configured globally)

The session does not exist in global configuration. Check the show run command output to ensure that a session with the right name has been configured.

Not operational (destination interface not known)

The session exists, but it either does not have a destination interface specified, or the destination interface named for the session does not exist (for example, if the destination is a sub-interface that has not been created).

Not operational (source same as destination)

The session exists, but the destination and source are the same interface, so traffic mirroring does not work.

Not operational (destination not active)

The destination interface or pseudowire is not in the Up state. See the corresponding Session status error messages for suggested resolution.

Not operational (source state <down-state>)

The source interface is not in the Up state. You can verify the state using the show interfaces command. Check the configuration to see what might be keeping the interface from coming up (for example, a sub-interface needs to have an appropriate encapsulation configured).

Error: see detailed output for explanation

Traffic mirroring has encountered an error. Run the show monitor-session status detail command to display more information.

Step 2

Use the show monitor-session status detail command to display full details of the configuration parameters, and of any errors encountered.

Example:

Router#show monitor-session status detail
Monitor-session sess1
 Destination interface is not configured
 Source Interfaces
 -----------------
 HundredGigE0/0/0/0
  Direction: Both
  ACL match: Enabled
  Portion:  Full packet
  Status:  Not operational (destination interface not known)
 HundredGigE0/0/0/2
  Direction: Both
  ACL match: Disabled
  Portion:  First 100 bytes
  Status: Not operational (destination interface not known). Error: 'Viking SPAN PD' detected the 'warning' condition 'PRM connection creation failure'.
Monitor-session foo
 Destination next-hop HundredGigE 0/0/0/0
 Source Interfaces
 -----------------
 HundredGigE 0/1/0/0.100:
  Direction: Both
  Status:  Operating
 HundredGigE 0/2/0/0.200:
  Direction: Tx
  Status:  Error: <blah>

Monitor session bar
 No destination configured
 Source Interfaces
 -----------------
 HundredGigE 0/3/0/0.100:
  Direction: Rx
  Status:  Not operational(no destination)

What to do next

After configuring an Ethernet interface, you can configure individual VLAN subinterfaces on the Ethernet interface.

For information about modifying Ethernet management interfaces for the shelf controller (SC), route processor (RP), and distributed RP, see the Advanced Configuration and Modification of the Management Ethernet Interface later in this document.

For information about IPv6, see the Implementing Access Lists and Prefix Lists on Cisco IOS XR Software module in the Cisco IOS XR IP Addresses and Services Configuration Guide.

Additional debug commands

This table details the various problem scenarios and how to troubleshoot them.

When..

Then..

there is no route to the destination IPv4 address

use the status command 

Router#show monitor-session mon2 status internal
Wed Oct 9 19:24:06.084 UTC
Information from SPAN Manager and MA on all nodes:
Monitor-session mon2 (ID 0x00000001) (Ethernet)
SPAN Mgr: Destination interface tunnel-ip2 (0x0f000034) (down)
Last error: Success
Tunnel data:
Mode: GREoIPv4
Source IP: 2.2.2.2
Dest IP: 130.10.10.2
VRF:
ToS: 0 (copied)
TTL: 255
DFbit: Not set
0/1/CPU0: Destination interface is not configured
Tunnel data:
Mode: GREoIPv4
Source IP: 2.2.2.2
Dest IP: 130.10.10.2
VRF:
ToS: 0 (copied)
TTL: 255
DFbit: Not set

there is a route to the destination IPv4 address
use this command:
Router#show cef ipv4 130.10.10.2
Wed Oct 9 19:25:12.282 UTC
0.0.0.0/0, version 0, proxy default, default route handler, drop adjacency, internal 0x1001011
0x0 (ptr 0x8e88d2b8) [1], 0x0 (0x8ea4d0a8), 0x0 (0x0)
Updated Oct 9 19:03:36.068
Prefix Len 0, traffic index 0, precedence n/a, priority 15
via 0.0.0.0/32, 3 dependencies, weight 0, class 0 [flags 0x0]
path-idx 0 NHID 0x0 [0x8e2db240 0x0]
next hop 0.0.0.0/32
drop adjacency

a route is present
use this command:
Router#show cef ipv4 130.10.10.2
Wed Oct 9 19:25:12.282 UTC
0.0.0.0/0, version 0, proxy default, default route handler, drop adjacency, internal 0x1001011
0x0 (ptr 0x8e88d2b8) [1], 0x0 (0x8ea4d0a8), 0x0 (0x0)
Updated Oct 9 19:03:36.068
Prefix Len 0, traffic index 0, precedence n/a, priority 15
via 0.0.0.0/32, 3 dependencies, weight 0, class 0 [flags 0x0]
path-idx 0 NHID 0x0 [0x8e2db240 0x0]
next hop 0.0.0.0/32
drop adjacency

ARP for the next hop is resolved, which is done by invoking a ping command to the destination
the show command output displays this output:
RP/0/RP0/CPU0:Router1#show monitor-session mon2 status internal
Wed Oct 9 19:32:24.856 UTC
Information from SPAN Manager and MA on all nodes:
Monitor-session mon2 (ID 0x00000001) (Ethernet)
SPAN Mgr: Destination interface tunnel-ip2 (0x0f000034)
Last error: Success
Tunnel data:
Mode: GREoIPv4
Source IP: 2.2.2.2
Dest IP: 130.10.10.2
VRF:
ToS: 0 (copied)
TTL: 255
DFbit: Not set
0/1/CPU0: Destination interface tunnel-ip2 (0x0f000034)
Tunnel data:
Mode: GREoIPv4
Source IP: 2.2.2.2
Dest IP: 130.10.10.2
VRF:
ToS: 0 (copied)
TTL: 255
DFbit: Not set
Information from SPAN EA on all nodes:
Monitor-session 0x00000001 (Ethernet)
0/1/CPU0: Name 'mon2', destination interface tunnel-ip2 (0x0f000034)
Platform, 0/1/CPU0:
Monitor Session ID: 1
Monitor Session Packets: 0
Monitor Session Bytes: 0
0/2/CPU0: Name 'mon2', destination interface tunnel-ip2 (0x0f000034)
Platform, 0/2/CPU0:
Monitor Session ID: 1
Monitor Session Packets: 0
Monitor Session Bytes: 0

These are the additional trace and debug commands for traffic mirroring.

  • show monitor-session platform trace

  • show monitor-session trace

  • debug monitor-session platform

  • debug monitor-session platform all

  • debug monitor-session platform event

  • debug monitor-session platform info

  • show monitor-session status

  • show monitor-session status

  • show monitor-session status errors

  • show monitor-session status internal