SPAN sources refer to the interfaces from which traffic can be monitored. The Cisco Nexus device supports Ethernet, Fibre Channel, virtual Fibre Channel, port channels, SAN port channels, VSANs and VLANs as SPAN sources. With VLANs or VSANs, all supported interfaces in the specified VLAN or VSAN are included as SPAN sources. You can choose the SPAN traffic in the ingress direction, the egress direction, or both directions for Ethernet, Fibre Channel, and virtual Fibre Channel source interfaces:

• Ingress source (Rx)—Traffic entering the device through this source port is copied to the SPAN destination port.

• Egress source (Tx)—Traffic exiting the device through this source port is copied to the SPAN destination port.

You can also configure SPAN source sessions to filter ingress traffic (Rx) by using VLAN access control lists (VACLs).

The Cisco Nexus 34180YC platform switch does not support VLANs as a span source.

A source port, also called a monitored port, is a switched interface that you monitor for network traffic analysis. The switch supports any number of ingress source ports (up to the maximum number of available ports on the switch) and any number of source VLANs.

A source port has these characteristics:

• Can be of Ethernet, port channel, or VLAN port type.

• Without an ACL filter configured, the same source can be configured for multiple sessions as long as either the direction or SPAN destination is different. However, each SPAN RX source should be configured for only one SPAN session with an ACL filter.

• Cannot be a destination port.

• Can be configured with a direction (ingress, egress, or both) to monitor. For VLAN sources, the monitored direction can only be ingress and applies to all physical ports in the group. The RX/TX option is not available for VLAN SPAN sessions.

• Ingress traffic can be filtered by using ACLs so that they mirror only those packets of information that match the ACL criteria.

• Can be in the same or different VLANs.

SPAN destinations refer to the interfaces that monitors source ports. The Cisco Nexus Series device supports Ethernet interfaces as SPAN destinations.

Each local SPAN session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports or VLANs. A destination port has these characteristics:

• Can be any physical port. Source Ethernet and FCoE ports cannot be destination ports.

• Cannot be a source port.

• Cannot be a port channel.

• Does not participate in spanning tree while the SPAN session is active.

• Is excluded from the source list and is not monitored if it belongs to a source VLAN of any SPAN session.

• Receives copies of sent and received traffic for all monitored source ports.

SPAN has the following guidelines and limitations:

• Beginning with Cisco NX-OS Release 7.0(3)I4(1), the same source (ethernet or port-channel) can be a part of multiple sessions. You can configure two monitor session with different destinations, but the same source VLAN is not supported.

• The combination of VLAN source session and port source session is not supported. If the traffic stream matches the VLAN source session as well as port source session, two copies are needed at two destination ports. Due to the hareware limitation, only the VLAN source SPAN and the specific destination port receive the SPAN packets.

  This limitation applies to the following Cisco devices:

  Table 1. Cisco Nexus 3000 Series Switches

  Cisco Nexus 3048TP	Cisco Nexus 31128PQ	Cisco Nexus 3132Q
  Cisco Nexus 3172PQ	Cisco Nexus 3172TQ	Cisco Nexus 3172TQ-XL

• Beginning with Cisco NX-OS Release 7.0(3)I4(1), multiple ACL filters are supported on the same 
source.

• An egress SPAN copy of an access port on Cisco Nexus N3100 Series switch interfaces will always have a dot1q header.

• In earlier releases, only tx info was displayed under the show monitor session command output. Starting with Release 7.0(3)I2(1), the output of the show monitor session command displays all directions for the source VLAN and it does not display any option for the filter VLAN.

• If you install Release NX-OS 5.0(3)U2(2) and then downgrade to a lower version of software, the SPAN configuration is lost.

  You must save the configuration before upgrading to Release NX-OS 5.0(3)U2(2), and then reapply the local span configurations after the downgrade.

  For information about a similar ERSPAN limitation, see Guidelines and Limitations for ERSPAN

• ACL filtering is supported only for Rx SPAN. Tx SPAN mirrors all traffics that egresses at the source interface.

• ACL filtering is not supported for IPv6 and MAC ACLs because of ternary content addressable memory (TCAM) width limitations.

• UDF-SPAN acl-filtering only supports source interface rx. This limitation applies to the following switches:

  • Cisco Nexus 3048TP

  • Cisco Nexus 31108TC-V

  • Cisco Nexus 3132Q-40GX

  • Cisco Nexus 3132Q-V

  • Cisco Nexus 31108PC-V

  • Cisco Nexus 3172PQ

  • Cisco Nexus 3172TQ

  • Cisco Nexus 3164Q

  • Cisco Nexus 31128PQ-10GE

  • Cisco Nexus 3232C

  • Cisco Nexus 3264Q

• The SPAN TCAM size is 128 or 256, depending on the ASIC. One entry is installed as the default and four are reserved for ERSPAN.

• If the same source is configured in more than one SPAN session, and each session has an ACL filter configured, the source interface is programmed only for the first active SPAN session. Hardware entries programmed for ACEs in other sessions is not included in this source interface.

• Both permit and deny access control entries (ACEs) are treated alike. Packets that match the ACE are mirrored irrespective of whether they have a permit or deny entry in the ACL.

  Note	A deny ACE does not result in a dropped packet. An ACL configured in a SPAN session determines only whether the packet is mirrored or not.

• It is recommended to use only the RX type of source traffic for SPAN to provide better performance because RX traffic is cut-through, whereas TX is store-and-forward. Hence, when monitoring both directions (RX and TX), the performance is not as good as when monitoring only RX. If you need to monitor both directions of traffic, you can monitor RX on more physical ports to capture both sides of the traffic.