SPAN

This chapter describes how to identify and resolve problems that relate to SPAN and includes the following topics:

•Information About SPAN

•Problems with SPAN

•SPAN Troubleshooting Commands

Information About SPAN

The Switched Port Analyzer (SPAN) feature (sometimes called port mirroring or port monitoring) selects network traffic for analysis by a network analyzer. The network analyzer can be a Cisco SwitchProbe or other Remote Monitoring (RMON) probe.

Cisco Nexus 1000V supports two types of SPAN:

•SPAN (local SPAN) that can monitor sources within a host or VEM.

•Encapsulated remote SPAN (ERSPAN) that can send monitored traffic to an IP destination.

For detailed information about how to configure local SPAN or ERSPAN, see the Cisco Nexus 1000V System Management Configuration Guide, Release 4.2(1)SV1(5.1).

SPAN Session Guidelines

The following are SPAN session guidelines:

•When a SPAN session contains multiple transmit source ports, packets that these ports receive may be replicated even though they are not transmitted on the ports. Examples include the following:

–Traffic that results from flooding

–Broadcast and multicast traffic

•For VLAN SPAN sessions with both receive and transmit configured, two packets (one from receive and one from transmit) are forwarded from the destination port if the packets get switched on the same VLAN.

•After VMotion:

–A session is stopped if the source and destination ports are separated.

–A session resumes if the source and destination ports end up on the same host.

•The following are required for a running SPAN session:

–The limit of 64 SPAN sessions is not exceeded.

–At least one operational source is configured.

–At least one operational destination is configured.

–The configured source and destination are on the same host.

–The session is enabled with the no shut command.

•A session is stopped if any of the following occur:

–All the source ports go down or are removed.

–All the destination ports go down or are removed.

–All the source and destination ports are separated by a VMotion.

–The session is disabled by a shut command.

Problems with SPAN

Symptom
Possible Causes
Solution

You observe issues with VM traffic after configuring a session with Ethernet destinations.

—

Ensure that the Ethernet destination is not connected to the same uplink switch. The SPAN packets might cause problems with the IP tables, the MAC tables, or both on the uplink switch, which can cause problems with the regular traffic.

A session state is up and the packets are not received at the destination ports.

—

Verify that the correct VLANs are allowed on the trunk destination ports.

The session displays an error.

—

1. Make sure that NX-OS VEM connectivity is working correctly.

2. Force reprogramming of the session on the VEM.

shut
no shut

The ERSPAN session is up, but does not see packets at the destination.

The ERSPAN ID is not configured.

Make sure that ERSPAN ID is configured at the destination.

An ERSPAN enabled VMKernel NIC is not configured on the host or VEM.

Make sure you create a VMKernel NIC on the host using a port profile configured for ERSPAN.

The ERSPAN enabled VMKernel NIC is not configured with a proper IP, gateway, or both.

Ping the ERSPAN IP destination from the host VMKernel NIC.

vmkping dest-id


SPAN Troubleshooting Commands

You can use the commands in this section to troubleshoot problems related to SPAN.

Command
Purpose

show monitor

Displays the status of SPAN sessions.

See Example 17-1.

show monitor session

Displays the current state of a SPAN session, the reason it is down, and the session configuration.

See Example 17-2.

module vem module-number execute vemcmd show span

Displays the VEM source IP and SPAN configuration.

See Example 17-3.

show monitor internal errors

 

show monitor internal event-history msgs

 

show monitor internal info global-info

 

show monitor internal mem-stats

 

Example 17-1 show monitor 

n1000v# show monitor

Session  State        Reason                  Description

-------  -----------  ----------------------  --------------------------------

17       down         Session admin shut      folio

Example 17-2 show monitor session 

n1000v(config)# show monitor session 1 

   session 1

---------------

type              : erspan-source

state             : up

source intf       : 

    rx            : Eth3/3 

    tx            : Eth3/3 

    both          : Eth3/3 

source VLANs      : 

    rx            : 

    tx            : 

    both          : 

filter VLANs      : filter not specified

destination IP    : 10.54.54.1

ERSPAN ID         : 999

ERSPAN TTL        : 64

ERSPAN IP Prec.   : 0

ERSPAN DSCP       : 0

ERSPAN MTU        : 1000

Example 17-3 module vem execute vemcmd show span 

n1000v# module vem 3 execute vemcmd show span

VEM SOURCE IP: 10.54.54.10

HW SSN ID DST LTL/IP ERSPAN ID

0 10.54.54.1 999 

1 48 local