Traffic Mirroring Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

PDF

SPAN to file with unique capture

Updated: February 5, 2026

Overview

This section explains the SPAN to file with unique capture feature, which captures a single packet for each punt-reason or interface.

The SPAN to file with unique capture is a traffic mirroring feature that

  • enables you to capture a single representative packet for each punt-reason or interface in a SPAN to file session,

  • simplifies packet analysis

  • reduces redundant data

  • introduces a new buffer that ensures only one packet per port and punt reason is saved, and

  • allows you to retain interesting packets while filtering out repetitive ones, making flow analysis more efficient.

SPAN to file with unique capture is implemented through the updated monitor-session command with options, such as unique-punt and unique-port .

Benefits of SPAN to file with unique capture

SPAN to file with unique capture offers several key benefits:

  • Retains individual packets of interest, even in the presence of many repeated packets.

  • Prevents important packets from being overwhelmed by repetitive traffic.

  • Captures a variety of packet types for efficient and focused analysis.

How SPAN to file with unique capture works

Summary

Here's how SPAN to file with unique capture works:

  • The SPAN to file with unique capture captures drop packets mirrored to the SPAN drop node and saves them to a PCAPng file.

  • The feature ensures uniqueness by identifying packets based on either the punt reason or the interface (port).

  • The process is managed by a database or table, ensuring only one packet is captured per punt reason or port in a unique buffer, separate from the main SPAN buffer.

Configure SPAN to file with unique capture

To configure SPAN-to-file with unique option, you must first create a monitor session using the monitor-session command. Choose the appropriate options to filter the drop traffic and specify whether to capture unique packets per punt reason, per port, or both.

Procedure

1.

Create a monitor session.

Example:

This example shows how to create a monitor-session. 

Router(config)# monitor-session mon1 ethernet 
Router(config-mon)#
2.

Configure monitor session to capture unique packets by using the unique-punt and unique-port options available within the drops command.

Example:

This example shows how to capture unique packets for each punt reason for packet-processing drops. 

Router(config)# monitor-session mon1 ethernet 
Router(config-mon)# destination interface tunnel-ip2
Router(config-mon)# drops packet-processing rx unique-punt
Router(config)# commit
Note

If neither packet-processing nor traffic-management is explicitly configured, the SPAN session will, by default, capture drops from both traffic-management and packet-processing.