SPAN sources refer to the interfaces from which traffic can be monitored. The Cisco Nexus device supports Ethernet, Fibre Channel, virtual Fibre Channel, port channels, SAN port channels, VSANs and VLANs as SPAN sources. With VLANs or VSANs, all supported interfaces in the specified VLAN or VSAN are included as SPAN sources. You can choose the SPAN traffic in the ingress direction, the egress direction, or both directions for Ethernet, Fibre Channel, and virtual Fibre Channel source interfaces:

• Ingress source (Rx)—Traffic entering the device through this source port is copied to the SPAN destination port.

• Egress source (Tx)—Traffic exiting the device through this source port is copied to the SPAN destination port.

Note	Fibre Channel ports and VSAN ports cannot be configured as ingress source ports in a SPAN session.

A source port, also called a monitored port, is a switched interface that you monitor for network traffic analysis. The switch supports any number of ingress source ports (up to the maximum number of available ports on the switch) and any number of source VLANs or VSANs.

A source port has these characteristics:

• Can be of Ethernet, Fibre Channel, virtual Fibre Channel, port channel, SAN port channel, VSAN or VLAN port type.

• Cannot be a destination port.

• Can be configured with a direction (ingress, egress, or both) to monitor. For VLAN and VSAN sources, the monitored direction can only be ingress and applies to all physical ports in the group. The RX/TX option is not available for VLAN or VSAN SPAN sessions.

• There is no limit to the number of egress SPAN ports, but there is upper limit of 128 source ports in the monitor session.

• Port Channel and SAN Port Channel interfaces can be configured as ingress or egress source ports.

• Can be in the same or different VLANs or VSANs.

• For VLAN or VSAN SPAN sources, all active ports in the source VLAN or VSAN are included as source ports.

SPAN destinations refer to the interfaces that monitors source ports. The Cisco Nexus Series device supports Ethernet and Fibre Channel interfaces as SPAN destinations.

Each local SPAN session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports, VSANs, or VLANs. A destination port has these characteristics:

• Can be any physical port. Source Ethernet, FCoE, and Fibre Channel ports cannot be destination ports.

• Cannot be a source port.

• Cannot be a port channel or SAN port channel group.

• Does not participate in spanning tree while the SPAN session is active.

• Is excluded from the source list and is not monitored if it belongs to a source VLAN of any SPAN session.

• Receives copies of sent and received traffic for all monitored source ports.

You create a SPAN session by assigning a session number using the monitor session command. If the session already exists, any additional configuration information is added to the existing session.

You can configure an Ethernet interface as a SPAN destination port.

Note	The SPAN destination port can only be a physical port on the switch.

To reduce the SPAN traffic bandwidth, you can configure the maximum bytes allowed for each replicated packet in a SPAN session. This value is called the maximum transmission unit (MTU) truncation size. Any SPAN packet larger than the configured size is truncated to the configured size.

Note	MTU Truncation is not supported for SPAN-on-Drop sessions.

Note	The SPAN destination port can only be a physical port on the switch.

You can configure a Fibre Channel port as a SPAN destination port.

A source port can be an Ethernet port, port channel, Fiber Channel ports, SAN port channel, VLAN, or a VSAN port. It cannot be a destination port.

You can configure the source channels for a SPAN session. These ports can be port channels SAN port channels, VSANs and VLANs. The monitored direction can be ingress, egress, or both and applies to all physical ports in the group.

For ease of reference, you can provide a descriptive name for a SPAN session.

To selectively monitor traffic in a SPAN session, you can configure an access-control list (ACL) to filter packets. The SPAN session ignores any permit or deny actions specified in the access-list, and spans only the packets that match the access-list filter criteria.

The default is to keep the session state shut. You can open a session that duplicates packets from sources to destinations.

By default, the session state is shut.

Note

The Cisco Nexus switch supports two active SPAN sessions. The Cisco Nexus 5548 Switch supports four active SPAN sessions. When you configure more than two SPAN sessions, the first two sessions are active. During startup, the order of active sessions is reversed; the last two sessions are active. For example, if you configured ten sessions 1 to 10 where 1 and 2 are active, after a reboot, sessions 9 and 10 will be active. To enable deterministic behavior, explicitly suspend the sessions 3 to 10 with the monitor session session-number shut command.