M Commands

match datalink

To configure the match data link (or Layer 2) attributes option in a flow record, use the match datalink command. To remove the data link configuration, use the no form of this command.

match datalink {mac source-address | mac destination-address | ethertype | vlan}

no match datalink {mac source-address | mac destination-address | ethertype | vlan}

Syntax Description

mac

Specifies the MAC address.

source-address

Specifies the source MAC address.

destination-address

Specifies the destination MAC address.

ethertype

Specifies the EtherType.

vlan

Specifies the VLAN ID.

Command Default

None

Command Modes

NetFlow record configuration (config-flow-record)

Command History

Release

Modification

7.0(0)N1(1)

This command was introduced.

Usage Guidelines

This command does not require a license.

Examples

This example shows how to configure the match data link attributes option in a flow record: 


switch(config)# flow record NetFlow1
switch(config-flow-record)# match datalink mac source-address
switch(config-flow-record)#

This example shows how to remove the data link match option from a flow record: 


switch(config-flow-record)# no
 match datalink mac source-address
switch(config-flow-record)#

Related Commands

Command

Description

match ip

Configures the match IP option for defining a NetFlow record map.

match ipv4

Configures the match IPv4 option for defining a NetFlow record map.

match ip

To configure the match IP option for defining a NetFlow record map, use the match ip command. To remove this option, use the no form of this command.

match ip {protocol | tos}

no match ip {protocol | tos}

Syntax Description

protocol

Specifies the protocol.

tos

Specifies the type of service (ToS).

Command Default

None

Command Modes

NetFlow record configuration (config-flow-record)

Command History

Release

Modification

7.0(0)N1(1)

This command was introduced.

Usage Guidelines

This command does not require a license.

Examples

This example shows how to configure the match IP option for defining a NetFlow record map: 


switch(config)# flow record Custom-NetFlow-Record-1
switch(config-flow-record)# match ip protocol
switch(config-flow-record)# match ip tos
switch(config-flow-record)#

This example shows how to remove the match option: 


switch(config-flow-record)# no match ip protocol
switch(config-flow-record)# no match ip tos
switch(config-flow-record)#

Related Commands

Command

Description

show flow record

Displays information about NetFlow records.

match ipv4

To configure the match IPv4 option for defining a NetFlow record map, use the match ipv4 command. To remove this option, use the no form of this command.

match ipv4 {source | destination} address

no match ipv4 {source | destination} address

Syntax Description

source

Specifies the source address.

destination

Specifies the destination address.

address

Specifies the address.

Command Default

None

Command Modes

NetFlow record configuration (config-flow-record)

Command History

Release

Modification

7.0(0)N1(1)

This command was introduced.

Usage Guidelines

This command does not require a license.

Examples

This example shows how to configure the match IPv4 option for defining a NetFlow record map: 


switch(config)# flow record Custom-NetFlow-Record-1
switch(config-flow-record)# match ipv4 source address
switch(config-flow-record)# match ipv4 destination address
switch(config-flow-record)#

This example shows how to remove the match IPv4 configuration: 


switch(config-flow-record)# no
 match ipv4 source address
switch(config-flow-record)# no
 match ipv4 destination address
switch(config-flow-record)#

Related Commands

Command

Description

show flow record

Displays information about NetFlow records.

match transport

To configure the match transport option for defining a NetFlow record map, use the match transport command. To remove the match transport option, use the no form of this command.

match transport {destination-port | source-port}

no match transport {destination-port | source-port}

Syntax Description

destination-port

Specifies the transport destination port.

source-port

Specifies the transport source port.

Command Default

None

Command Modes

NetFlow record configuration (config-flow-record)

Command History

Release

Modification

7.0(0)N1(1)

This command was introduced.

Usage Guidelines

This command does not require a license.

Examples

This example shows how to configure the match transport option for defining a NetFlow record map: 


switch(config)# flow record Custom-NetFlow-Record-1
switch(config-flow-record)# 
match transport source-port

This example shows how to remove the configuration: 


switch(config-flow-record)# no
 match transport source-port
switch(config-flow-record)

Related Commands

Command

Description

show flow record

Displays information about NetFlow records.

mode

To specify the mode in a NetFlow sampler, use the mode command. To remove the mode, use the no form of this command.

mode samples out-of packets

no mode [samples out-of packets]

Syntax Description

samples

Number of samples per sampling. The range is from 1 to 64.

out-of

M out of N packets.

packets

Number of packets in each sampling. The range is from 1 to 65536, and must be a power of 2.

Command Default

None

Command Modes

NetFlow sampler configuration (config-flow-sampler)

Command History

Release

Modification

7.0(0)N1(1)

This command was introduced.

Usage Guidelines

This command does not require a license.

Examples

This example shows how to specify the mode in a NetFlow sampler: 


switch(config)# 
sampler Custom-NetFlow-Sampler-1
switch(config-flow-sampler)# mode 1 out-of 1024
switch(config-flow-sampler)#

This example shows how to remove the mode configuration: 


switch(config-flow-sampler)# no mode

Related Commands

Command

Description

show sampler

Displays information about NetFlow samplers.

monitor erspan origin ip-address

To configure the Encapsulated Remote Switched Port Analyzer (ERSPAN) origin IP address, use the monitor espan origin ip-address command. To remove the ERSPAN origin IP address configuration, use the no form of this command.

monitor erspan origin ip-address ip-address [global]

no monitor erspan origin ip-address ip-address [global]

Syntax Description

ip-address

IP address.

global

(Optional) Specifies the default virtual device context (VDC) configuration across all VDCs.

Command Default

None

Command Modes

Global configuration mode

Command History

Release

Modification

6.0(2)N1(1)

This command was introduced.

Usage Guidelines

When you change the origin IP address in the default VDC, it impacts all the sessions.

This command does not require a license.

Examples

This example shows how to configure the ERSPAN origin IP address: 


switch# configure terminal
switch(config)# monitor erspan origin ip-address 10.1.1.1 global
switch(config)#

This example shows how to remove the ERSPAN IP address: 


switch# configure terminal
switch(config)# no monitor erspan origin ip-address 10.1.1.1 global
switch(config)#

Related Commands

Command

Description

monitor session

Configures a SPAN or an ERSPAN session.

monitor session

To create a new Ethernet Switched Port Analyzer (SPAN) or an Encapsulated Remote Switched Port Analyzer (ERSPAN) session configuration for analyzing traffic between ports or add to an existing session configuration, use the monitor session command. To clear SPAN or ERSPAN sessions, use the no form of this command.

monitor session session-number [shut | type {local | erspan-destination | erspan-source | span-on-drop | span-on-drop-erspan | span-on-latency | span-on-latency-erspan} | all shut]

no monitor session {session-number | all} [shut]

Syntax Description

session-number

SPAN session to create or configure. The range is from 1 to 48.

all

Specifies to apply configuration information to all SPAN sessions.

shut

(Optional) Specifies that the selected session will be shut down for monitoring.

type

(Optional) Specifies the type of session to configure.

local

Specifies the session type to be local.

erspan-destination

Creates an ERSPAN destination session.

erspan-source

Creates an ERSPAN source session.

span-on-drop

Creates a SPAN on drop session.

span-on-drop-erspan

Creates a SPAN on drop ERSPAN session.

span-on-latency

Creates a SPAN on latency session

span-on-latency-erspan

Creates a SPAN on latency ERSPAN session

suspend

(Optional) Specifies to suspend the referenced SPAN session.

Command Default

None

Command Modes

Global configuration mode

Command History

Release

Modification

7.0(0)N1(1)

This command was modified. Support was added for the erspan-destination, span-on-drop, span-on-drop-erspan, span-on-latency, span-on-latency-erspan keywords, and the session-number range was increased from 18 to 48.

6.0(2)N1(1)

This command was introduced.

Usage Guidelines

To ensure that you are working with a completely new session, you can clear the desired session number or all SPAN sessions.


Note
The limit on the number of egress (TX) sources in a monitor session has been lifted. Port-channel interfaces can be configured as egress sources.

After you create an ERSPAN session, you can describe the session and add interfaces and VLANs as sources and destinations.

Examples

This example shows how to create a SPAN session: 


switch# configure terminal
 
switch(config)# monitor session 2
 
switch(config)#

This example shows how to enter the monitor configuration mode for configuring SPAN session number 9 for analyzing traffic between ports: 


switch(config)# monitor session 9 type local
 
switch(config-monitor)# description A Local SPAN session
 
switch(config-monitor)# source interface ethernet 1/1
 
switch(config-monitor)# destination interface ethernet 1/2
 
switch(config-monitor)# no shutdown

This example shows how to configure any SPAN destination interfaces as Layer 2 SPAN monitor ports before activating the SPAN session: 


switch(config)# interface ethernet 1/2
 
switch(config-if)# switchport
 
switch(config-if)# switchport monitor
 
switch(config-if)# no shutdown

This example shows how to configure a typical SPAN destination trunk interface: 


switch(config)# interface Ethernet1/2
 
switch(config-if)# switchport
 
switch(config-if)# switchport mode trunk
 
switch(config-if)# switchport monitor
 
switch(config-if)# switchport trunk allowed vlan 10-12
 
switch(config-if)# no shutdown

This example shows how to create an ERSPAN source session: 


switch# configure terminal
 
switch(config)# monitor session 1 type erspan-source
switch(config-erspan-src)# description ERSPAN-source-session
switch(config-erspan-src)# source interface ethernet 1/5 rx
switch(config-erspan-src)# destination ip 192.0.3.1
switch(config-erspan-src)# erspan-id 100
switch(config-erspan-src)# filter access-group acl_erspan_ses_3
switch(config-erspan-src)# ip dscp 10
switch(config-erspan-src)#

This example shows how to create an ERSPAN destination session: 


switch(config)# interface ethernet 2/5
switch(config-if)# switchport monitor
switch(config-if)# no monitor session 3
switch(config-if)# monitor session 3 type erspan-destination
switch(config-erspan-dst)# description erspan_dst_session_3
switch(config-erspan-dst)# source ip 10.1.1.1
switch(config-erspan-dst)# destination interface ethernet 2/5
switch(config-erspan-dst)# erspan-id 5
switch(config)# no shut

This example shows how to create a SPAN-on-Latency session: 


switch(config)# interface Ethernet 1/2
 
switch(config-if)# switchport monitor
switch(config-if)# packet latency threshold 530000000
switch(config)# monitor session 9 type span-on-latency
switch(config-span-on-latency# description span-on-latency-session
switch(config-span-on-latency)# source interface ethernet 4/1
switch(config-span-on-latency)# destination interface ethernet 4/5

This example shows how to create an ERSPAN SPAN-on-Latency session: 


switch(config)# interface Ethernet 1/1
 
switch(config-if)# switchport monitor
switch(config-if)# packet latency threshold 530000000
switch(config)# monitor session 10 type span-on-drop-latency-erspan
switch(config-span-on-latency-erpsan)# description span-on-latency-erspan-session
switch(config-span-on-latency-erpsan)# destination ip 192.0.3.1
switch(config-span-on-latency-erspan)#

Related Commands

Command

Description

description (SPAN, ERSPAN)

Adds a description to identify the SPAN session.

destination (ERSPAN)

Configures the destination IP port for an ERSPAN packet.

erspan-id (ERSPAN)

Sets the flow ID for an ERSPAN session.

ip dscp (ERSPAN)

Sets the DSCP value for an ERSPAN packet.

ip prec (ERSPAN)

Sets the IP precedence value for an ERSPAN packet.

ip ttl (ERSPAN)

Sets the time-to-live (TTL) value for an ERSPAN packet.

mtu (ERSPAN)

Sets the maximum transmission value (MTU) for ERSPAN packets.

packet latency threshold

Configures the latency threshold value on an interface.

show monitor session

Displays SPAN session configuration information.

source (SPAN, ERSPAN)

Adds a SPAN source port.

mtu

To configure the maximum transmission unit (MTU) truncation size for packets in the specified Ethernet Switched Port Analyzer (SPAN) session, use the mtu command. To remove the MTU truncation size configuration, use the no form of this command.

mtu mtu-size

no mtu

Syntax Description

mtu-size

MTU truncation size. The range is from 64 to 1518.

Command Default

Disabled

Command Modes

SPAN session configuration mode (config-monitor)

ERSPAN source session configuration mode (config-erspan-src)

SPAN-on-Latency session configuration mode (config-span-on-latency)

SPAN-on-Latency ERSPAN session configuration mode (config-span-on-latency-erspan)

Command History

Release

Modification

7.0(0)N1(1)

This command was modified. This command was implemented in the following modes: ERSPAN source session configuration mode, SPAN-on-Latency session configuration mode, and SPAN-on-Latency ERSPAN session configuration mode. The upper limit of the range was changed from 1500 to 1518.

6.0(2)N1(1)

This command was introduced.

Usage Guidelines

This command does not require a license.

Examples

This example shows how to configure the MTU truncation size for packets in the specified SPAN session: 


switch# configure terminal
switch(config)# monitor session 5
switch(config-monitor)# mtu 128
switch(config-monitor)#

This example shows how to remove the MTU truncation size configuration for packets in the specified SPAN session: 


switch# configure terminal
switch(config)# monitor session 5
switch(config-monitor)# no mtu

Related Commands

Command

Description

monitor session

Places you in the monitor configuration mode for configuring a SPAN session.

show monitor session

Displays the status of the SPAN session.