Configuring SPAN

---

SPAN sources refer to the interfaces from which traffic can be monitored. The Cisco Nexus device supports Ethernet, Fibre Channel, virtual Fibre Channel, port channels, SAN port channels, VSANs and VLANs as SPAN sources. With VLANs or VSANs, all supported interfaces in the specified VLAN or VSAN are included as SPAN sources. You can choose the SPAN traffic in the ingress direction, the egress direction, or both directions for Ethernet, Fibre Channel, and virtual Fibre Channel source interfaces:

• Ingress source (Rx)—Traffic entering the device through this source port is copied to the SPAN destination port.

• Egress source (Tx)—Traffic exiting the device through this source port is copied to the SPAN destination port.

If the SPAN source interface sends more than 6-Gbps traffic or if traffic bursts too much, the device drops traffic on the source interface. You can use the switchport monitor rate-limit 1G command on the SPAN destination to reduce the dropping of actual traffic on the source interface; however, SPAN traffic is restricted to 1 Gbps. For additional information see Configuring the Rate Limit for SPAN Traffic

Note	The switchport monitor rate-limit 1G command is not supported on the Nexus 5500 platform.

On the Cisco Nexus 5548 device, Fibre Channel ports and VSAN ports cannot be configured as ingress source ports in a SPAN session.

A source port, also called a monitored port, is a switched interface that you monitor for network traffic analysis. The switch supports any number of ingress source ports (up to the maximum number of available ports on the switch) and any number of source VLANs or VSANs.

A source port has these characteristics:

• Cannot be a destination port.

• Can be configured with a direction (ingress, egress, or both) to monitor. For VLAN and VSAN sources, the monitored direction can only be ingress and applies to all physical ports in the group. The RX/TX option is not available for VLAN or VSAN SPAN sessions.

• There is no limit to the number of egress SPAN ports, but there is upper limit of 128 source ports in the monitor session.

• Port Channel and SAN Port Channel interfaces can be configured as ingress or egress source ports.

• Can be in the same or different VLANs or VSANs.

• For VLAN or VSAN SPAN sources, all active ports in the source VLAN or VSAN are included as source ports.

SPAN destinations refer to the interfaces that monitors source ports. The Cisco Nexus Series device supports Ethernet and Fibre Channel interfaces as SPAN destinations.

Each local SPAN session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports, VSANs, or VLANs. A destination port has these characteristics:

• Cannot be a source port.

• Cannot be a port channel or SAN port channel group.

• Does not participate in spanning tree while the SPAN session is active.

• Is excluded from the source list and is not monitored if it belongs to a source VLAN of any SPAN session.

• Receives copies of sent and received traffic for all monitored source ports.

You create a SPAN session by assigning a session number using the monitor session command. If the session already exists, any additional configuration information is added to the existing session.

You can configure an Ethernet interface as a SPAN destination port.

Note	The SPAN destination port can only be a physical port on the switch.

To reduce the SPAN traffic bandwidth, you can configure the maximum bytes allowed for each replicated packet in a SPAN session. This value is called the maximum transmission unit (MTU) truncation size. Any SPAN packet larger than the configured size is truncated to the configured size.

Note	MTU Truncation is not supported for SPAN-on-Drop sessions.

By configuring a rate limit for SPAN traffic to 1Gbps across the entire monitor session, you can avoid impacting the monitored production traffic.

Note	The SPAN destination port can only be a physical port on the switch.

You can configure a Fibre Channel port as a SPAN destination port.

You can configure the source channels for a SPAN session. These ports can be port channels SAN port channels, VSANs and VLANs. The monitored direction can be ingress, egress, or both and applies to all physical ports in the group.

For ease of reference, you can provide a descriptive name for a SPAN session.

The default is to keep the session state shut. You can open a session that duplicates packets from sources to destinations.

By default, the session state is shut.

Note

The Cisco Nexus switch supports two active SPAN sessions. The Cisco Nexus 5548 Switch supports four active SPAN sessions. When you configure more than two SPAN sessions, the first two sessions are active. During startup, the order of active sessions is reversed; the last two sessions are active. For example, if you configured ten sessions 1 to 10 where 1 and 2 are active, after a reboot, sessions 9 and 10 will be active. To enable deterministic behavior, explicitly suspend the sessions 3 to 10 with the monitor session session-number shut command.