The Switched Port Analyzer (SPAN) feature (sometimes called port mirroring or port monitoring) selects network traffic for analysis by a network analyzer. The network analyzer can be a Cisco SwitchProbe or other Remote Monitoring (RMON) probes.

The SPAN-on-drop feature enables the spanning of packets which would normally be dropped due to unavailable buffer or queue space on ingress. Instead of dropping a packet when congestion occurs, the system stores the packet in a separate SPAN-on-drop buffer and then sends the packet to the specified SPAN-on-drop destination port.

The SPAN-on-Latency feature allows the system to SPAN packets that exceed a pre-configured latency threshold.

For high-latency flows the system can be configured to send a copy to any pre-configured SPAN destination. This creates a data set for analytics that can be used to check which applications are impacted by increased latency in the network. This feature can also be used to identify traffic flows that experience congestion.

Packets exceeding the latency measurements, egressing out of the source port only will be spanned.

Note	SPAN copies can be transported to a local analyzer port, or remote analyzer using IPFIX/ERSPAN encapsulation. The SPAN copies can be truncated to save bandwidth.

SPAN is not supported on a management interface.

If an interface is configured as a source port for a SPAN session, either directly as a source interface or indirectly as part of a port-channel, traffic from this interface will not be visible in VLAN SPAN sessions that include this interface as part of a configured VLAN. This limitation occurs as the Ternary Content-Addressable Memory (TCAM) entries for interface SPAN sources are always programmed before the TCAM entries for VLAN SPAN sources.

Cisco Nexus 6000 devices support 16 active local SPAN or ERSPAN-source sessions, 16 active ERSPAN-destination sessions and one active SPAN-on-Drop or SPAN-on-Drop-ERSPAN session.

The following guidelines and limitations apply to SPAN session where multiple destinations are configured:

• Multiple destinations are supported for Local SPAN or SPAN-on-Drop sessions only. Multiple destinations are not supported on ERSPAN or SPAN-on-Latency sessions.

• The maximum number of unique destinations configured on all active sessions is 16. A single SPAN session can have a maximum of 16 destinations, and a SPAN-on-Drop session can have a maximum of 17 destinations, in which case no further SPAN sessions can be configured.

• You cannot SPAN a single source VLAN to multiple destination ports.

• Connecting SPAN destination ports to a switch device is not supported.

The following guidelines and limitations apply to SPAN-on-Drop sessions:

• Only Ethernet source interfaces are supported (port channels not supported). Sources can be a part of a SPAN-on-Drop session and a local SPAN session simultaneously.

• At most one SPAN-on-Drop or SPAN-on-Drop ERSPAN session may be active at the same time.

• Directions on source interfaces are not supported.

• FEX interfaces are not supported as sources for SPAN-on-Drop sessions. However, fabric interfaces are supported. Setting all fabric interfaces associated with a FEX as sources allows SPAN-on-Drop sessions to be enabled on all FEX ports associated with that fabric interface.

• Multicast egress drops are not spanned. SPAN-on-Drop applies only to packets dropped in ingress due to a lack of buffer resources or when the Virtual Output Queueing (VOQ) size exceeds the preprogrammed threshold.

• ACL-based SPAN is not supported

• Configuring the maximum transmission unit (MTU) truncation size for packets is not supported for SPAN-on-Drop sessions.

The following guidelines and limitations apply to SPAN-on-Latency sessions:

• Although SPAN-on-Latency detection is performed on a per-port basis, the span pointer configuration is a global value.

• The maximum latency threshold value configuration is per 40 Gigabit port. Therefore, if there the system has 10 Gigabit ports, the latency threshold is shared by four 10 Gigabit ports.

• At most only one SPAN-on-Latency or SPAN-on-Latency ERSPAN session may be active at the same time.

• You must issue the clear hardware profile latency monitor all command when the switch is reloaded or when a module is powered on. Until you issue this command no packets are spanned.

• Even though fabric interfaces are supported as sources, FEX interfaces and Port Channel are not supported as sources.

• Span-on-Latency Source cannot be part of any other span session i.e. Local Span or Span-on-drop.

• ACL based SOL is not supported.

• Local SPAN/SPAN on Drop/SPAN on Latency is not aware of VPC.

• The following is the limitation for HIF and Virtual Ethernet (Veth) as SPAN destination:

  • Multi-destination SPAN is not supported. If HIF/VETH port is a destination, the monitor session must have single destination.

  • A SPAN destination port, which is part of an active SPAN session, receives flood traffic. You can prevent this behavior by using the unknown unicast flood block feature. To enable this feature, use the switchport block unicast command.

If a SPAN session is down, do the following:

• Check if one of the destination port is operational by performing the following:

  • Use the show running interface interface command and check if the switchport monitor is configured.

  • Use the show interface interface command and check if the destination interface shows the status as "admin up".

• Use the show interface interface command to check if one of the source port is operational and if the source interface shows the status as "admin up".

This example shows how to configure an SPAN-on-Latency session:

switch# configure terminal
switch(config) # interface ethernet 1/1
switch(config-if) # packet latency threshold 530000000
switch(config) # monitor session 11 type span-on-latency
switch(config-span-on-latency) # description span-on-latency-session_11
switch(config-span-on-latency) # source interface ethernet 1/3
switch(config-span-on-latency) # destination interface ethernet 1/1
switch(config-span-on-latency) # mtu 1500
switch(config) # copy running-config startup-config
switch(config) #