Traffic Mirroring Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

PDF

Configure buffer drop packets mirroring for SPAN to file

Updated: March 2, 2026

Want to summarize with AI?

Log in

Overview

Use this procedure to configure a global monitor session that mirrors buffer drop packets directly to a file destination.

Perform the these steps on the router to configure a global session for mirroring buffer drop packets for SPAN to file destination:

Procedure

1.

Configure a traffic mirroring session and specify the destination as file.

Example:


Router(config)# monitor-session S2F_sessnethernet
Router(config-mon)# destination file
Router(config-mon)# exit
2.

Attach SPAN to file monitor session to the interface.

Example:

Router(config)# interface HundredGigE0/0/0/0 
Router(config-if)# monitor-session S2F_sessnethernet direction rx-only
Router(config-if-mon)# exit
3.

Create a global monitor session for TM drop packets and enable the TM buffer drop feature for SPAN to file destination.

Example:


Router(config)# monitor-session mon1 ethernet
Router(config-mon)# destination file
Router(config-mon)# drops traffic-management rx
Router(config-mon)# commit
4.

Configure a policer on the ingress interface and send the traffic at a line rate faster than the policer. The router drops the packets with the reason PACKET_GOT_DROPPED_DUE_TO_EXACT_METER (displayed as TM_EXACT_METER_DROP).

Example:

Router(config)# class-map match-any dscp1
Router(config-cmap)# match dscp ipv4 1
Router(config-cmap)# end-class-map
Router(config)# policy-map test-police-1R2C
Router(config-pmap)# class dscp1
Router(config-pmap-c)# police rate 100 mbps
Router(config-pmap-c-police)# exit
Router(config-pmap-c)# class class-default
Router(config-pmap-c)# police rate 100 mbps
Router(config-pmap-c-police)# exit
Router(config-pmap-c)# end-policy-map
Router(config)# interface HundredGigE0/0/0/0
Router(config-if)# service-policy input test-police-1R2C
Router(config-if)# commit
5.

Configure a regular SPAN to file on the ingress interface and send the traffic at 100% line rate. The router drops the packets with the reason PACKET_GOT_DROPPED_DUE_TO_STATISTICAL_METER (Displayed as: TM_STATISTICAL_METER_DROP).
6.

Verify the buffer drop packets are mirrored using the show monitor-session status command.

Example:

Router# show controllers npu stats traps-all instance all location 0/RP0/CPU0
Trap Type                                 NPU  Trap  Punt       Punt  Punt  Punt Configured Hardware   Policer Avg-Pkt Packets              Packets
                                          ID   ID    Dest       VoQ   VLAN  TC   Rate(pps)  Rate(pps)  Level   Size    Accepted             Dropped
====================================================================================================================================================================
TM_EXACT_METER_DROP                      0    256  RPLC_CPU    208   1538  0    542          523    NPU     N/A     25              18167604
TM_STATISTICAL_METER_DROP                0    257  RPLC_CPU    208   1538  0    542          523    NPU     N/A     31143           18167604  

Router# show spp node-counters location all | i SPAN
SPAN to File: 55724
SPAN drop: 31168

The Packets Accepted counter of the statistical meter dropped packets and exact meter dropped packets in show controllers npu stats traps-all should match the "SPAN drop" counter in show spp node-counters within an acceptable range. This is because the statistics displayed are not updated in real-time; they refresh every 30 seconds from the hardware.