SPAN

This chapter describes how to identify and resolve problems that relate to SPAN.

Information About SPAN

The Switched Port Analyzer (SPAN) feature (sometimes called port mirroring or port monitoring) selects network traffic for analysis by a network analyzer. The network analyzer can be a Cisco SwitchProbe or other Remote Monitoring (RMON) probe.

The Cisco Nexus 1000V supports two types of SPAN:

  • SPAN (local SPAN) that can monitor sources within a host or Virtual Ethernet Module (VEM).
  • Encapsulated remote SPAN (ERSPAN) that can send monitored traffic to an IP destination.

For detailed information about how to configure local SPAN or ERSPAN, see the Cisco Nexus 1000V for Microsoft Hyper-V System Management Configuration Guide.

SPAN Session Guidelines

The following are SPAN session guidelines:

  • When a SPAN session contains multiple transmit source ports, packets that these ports receive might be replicated even though they are not transmitted on the ports. Examples include the following:

– Traffic that results from flooding

– Broadcast and multicast traffic

  • For VLAN SPAN sessions with both receive and transmit configured, two packets (one from receive and one from transmit) are forwarded from the destination port if the packets get switched on the same VLAN.
  • After a live migration ( a live migration provides the capability to move a virtual machine (VM) from one node in a Microsoft Windows server failover cluster to another node without a perceived interruption in service by applications/clients connecting to the VM), the following might occur:

– A session is stopped if the source and destination ports are separated.

– A session resumes if the source and destination ports end up on the same host.

  • The following are required to run a SPAN session:

– The limit of 64 SPAN sessions is not exceeded.

– At least one operational source is configured.

– At least one operational destination is configured.

– The configured source and destination are on the same host.

– The session is enabled with the no shut command.

  • A session is stopped if any of the following occur:

– All the source ports go down or are removed.

– All the destination ports go down or are removed.

– All the source and destination ports are separated by a live migration.

– The session is disabled by a shut command.

Problems with SPAN

 

Symptom
Possible Causes
Solution

You observe issues with VM traffic after configuring a session with Ethernet destinations.

—

Ensure that the Ethernet destination is not connected to the same uplink switch. The SPAN packets might cause problems with the IP tables, the MAC address tables, or both on the uplink switch, which can cause problems with the regular traffic.

A session state is up and the packets are not received at the destination ports.

—

Verify that the correct VLANs are allowed on the trunk destination ports.

The session displays an error.

—

1. Make sure that the Cisco NX-OS VEM connectivity is working correctly.

2. Force reprogramming of the session on the VEM by entering these commands:

– shut

– no shut

The ERSPAN session is up but does not see packets at the destination.

The ERSPAN ID is not configured.

Make sure that ERSPAN ID is configured at the destination.

SPAN Troubleshooting Commands

You can use the commands in this section to troubleshoot problems related to SPAN.

 

Command
Purpose
show monitor

Displays the status of SPAN sessions.

See Example 17-1 on page 17-3 .

show monitor session

Displays the current state of a SPAN session, the reason it is down, and the session configuration.

See Example 17-2 on page 17-3 .

module vem module-number execute vemcmd show span

Displays the VEM source IP and SPAN configuration.

See Example 17-3 on page 17-4 .

show monitor internal errors

Displays the error logs.

show monitor internal event-history msgs

Displays the event history messages.

show monitor internal info global-info

Displays the global component information.

show monitor internal mem-stats

Displays the memory allocation statistics.

Example 17-1 show monitor command

n1000v# show monitor
Session State Reason Description
------- ----------- ---------------------- --------------------------------
17 down Session admin shut folio

Example 17-2 show monitor session command

n1000v(config)# show monitor session 1
session 1
---------------
type : erspan-source
state : up
ERSPAN ID : 999
source intf :
rx : Eth3/3
tx : Eth3/3
both : Eth3/3
source VLANs :
rx :
tx :
both :
source port-profile :
rx :
tx :
both :
filter VLANs : filter not specified
destination IP : 10.54.54.1
ERSPAN TTL : 64
ERSPAN IP Prec. : 0
ERSPAN DSCP : 0
ERSPAN MTU : 1000
ERSPAN Header Type: 2

Example 17-3 module vem execute vemcmd show span command

n1000v# module vem 3 execute vemcmd show span
HW SSN ID ERSPAN ID HDR VER DST LTL/IP
1 180 2 10.54.54.1
RX Sources :17,18,
TX Sources :305,
Source Filter RX :261,263,264,
Source Filter TX:261,263,264,