Introduction to Traffic Mirroring
Traffic mirroring, sometimes called port mirroring or Switched Port Analyzer (SPAN), is a Cisco proprietary feature that enables you to monitor network traffic passing in or out of a set of ports. You can then pass this traffic to a destination port on the same router.
Traffic mirroring copies traffic from one or more source ports and sends the copied traffic to one or more destinations for analysis by a network analyzer or other monitoring device. Traffic mirroring does not affect the flow of traffic on the source interfaces or sub-interfaces. It allows the mirrored traffic to be sent to a destination interface or sub-interface.
For example, you can attach a traffic analyzer to the router and capture Ethernet traffic that is sent by host A to host B.
![](/c/dam/en/us/td/i/200001-300000/280001-290000/281001-282000/281709.eps/_jcr_content/renditions/281709.jpg)
When local traffic mirroring is enabled, the traffic analyzer gets directly attached to the port that is configured to receive a copy of every packet that host A sends. This port is called a traffic mirroring port.
![]() Note |
From Release 7.2.1, traffic mirroring is introduced on Cisco NC57 line cards. From Release 7.4.2, you can mirror incoming(rx) and outgoing(tx) traffic from the source ports to separate destinations on Cisco NC57 line cards. During a session, you can configure one destination port for incoming traffic and one for outgoing traffic. |
Traffic Mirroring Types
The following types of traffic mirroring are supported:
-
Local traffic mirroring: This is the most basic form of traffic mirroring. The network analyzer or sniffer is attached directly to the destination interface. In other words, all monitored ports are located on the same router as the destination port.
-
Remote traffic mirroring: The network analyzer is reached through a GRE tunnel over an IP network.
Note
A copy of every packet includes the Layer 2 header if the ethernet keyword is configured. As this renders the mirrored packets unroutable, the end point of the GRE tunnel must be the network analyzer.
-
ACL-based traffic mirroring: Traffic is mirrored based on the configuration of the interface ACL.
You can mirror traffic based on the definition of an interface access control list. When you are mirroring Layer 3 traffic, the ACL is configured using the ipv4 access-list or the ipv6 access-list command with the capture option. The permit and deny commands determine the behavior of regular traffic. The capture option designates the packet is to be mirrored to the destination port, and it is supported only on permit type of access control entries (ACEs).
Note
Prior to Release 6.5.1, ACL-based traffic mirroring required the use of UDK (User-Defined TCAM Key) with the enable-capture option so that the capture option can be configured in the ACL.
Traffic Mirroring Terminology
-
Ingress Traffic — Traffic that comes into the router.
-
Egress Traffic — Traffic that goes out of the router.
-
Source (SPAN) interface — An interface that is monitored using the SPAN feature.
-
Source port—A port that is monitored with the use of traffic mirroring. It is also called a monitored port.
-
Destination port—A port that monitors source ports, usually where a network analyzer is connected. It is also called a monitoring port.
-
Monitor session—A designation for a collection of SPAN configurations consisting of a single destination and, potentially, one or many source interfaces.
Characteristics of Source Port
A source port, also called a monitored port, is a routed port that you monitor for network traffic analysis. In a single traffic mirroring session, you can monitor source port traffic. The NCS 5500 Series Router supports a maximum of up to 800 source ports.
A source port has these characteristics:
-
It can be any data port type, such as Bundle Interface, 100 Gigabit Ethernet, or 10 Gigabit Ethernet.
Note
Bridge group virtual interfaces (BVIs) are not supported.
-
Each source port can be monitored in only one traffic mirroring session.
-
When a port is used as a source port, the same port cannot be used as a destination port.
-
Each source port can be configured with a direction (ingress, egress, or both) to monitor local traffic mirroring. Remote traffic mirroring is supported both in the ingress and egress directions. For bundles, the monitored direction applies to all physical ports in the group.
Characteristics of Monitor Session
A monitor session is a collection of traffic mirroring configurations consisting of a single destination and, potentially, many source interfaces. For any given monitor session, the traffic from the source interfaces (called source ports) is sent to the monitoring port or destination port. If there are more than one source port in a monitoring session, the traffic from the several mirrored traffic streams is combined at the destination port. The result is that the traffic that comes out of the destination port is a combination of the traffic from one or more source ports.
Monitor sessions have these characteristics:
-
A single router can have a maximum of four monitor sessions. However, both SPAN and CFM share common mirror profiles. If you configure SPAN and CFM together on the router, the maximum number of monitor sessions may reduce to two.
-
Cisco NC57 line cards support only four Rx and three Tx monitor sessions.
-
A single monitor session can have only one destination port.
-
A single destination port can belong to only one monitor session.
-
A monitor session can have a maximum of 800 source ports, as long as the maximum number of source ports from all monitoring sessions does not exceed 800.
Characteristics of Destination Port
Each session must have a destination port that receives a copy of the traffic from the source ports.
A destination port has these characteristics:
-
A destination port must reside on the same router as the source port for local traffic mirroring. For remote mirroring, the destination is always a GRE tunnel.
-
A destination port for local mirroring can be any Ethernet physical port, EFP, GRE tunnel interface, or bundle interface. It can be a Layer 2 or Layer 3 transport interface.
-
A destination port on NCS5500 cannot be a VLAN subinterface.
-
At any one time, a destination port can participate in only one traffic mirroring session. A destination port in one traffic mirroring session cannot be a destination port for a second traffic mirroring session. In other words, no two monitor sessions can have the same destination port.
-
A destination port cannot also be a source port.
Restrictions
The following are the generic restriction(s):
-
Partial mirroring and sampled mirroring are not supported.
-
The destination bundle interfaces flap when:
-
both the mirror source and destination are bundle interfaces in LACP mode and
-
mirror packets next-hop is a router or a switch instead of a traffic analyzer.
This behavior is observed due to a mismatch of LACP packets on the next-hop bundle interface due to the mirroring of LACP packets on the source bundle interface.
-
The following general restrictions apply to traffic mirroring using ACLs:
-
Traffic mirroring counters are not supported.
-
ACL-based traffic mirroring is not supported with Layer 2 (ethernet-services) ACLs.
-
Configure ACL(s) on the source interface or any interface on the same network processing unit as the source interface, to avoid default mirroring of traffic. If a Bundle interface is a source interface, configure the ACL(s) on any interface on the same network processing unit as all active bundle-members. Bundle members can be on multiple NPUs. Also ensure that the ACL(s) configured are of the same protocol type and direction as the SPAN configuration. For example, if you configure SPAN with ACL for IPv4 or IPv6, configure an ingress IPv4 or IPv6 ACL on that network processing unit respectively.
The following general restrictions apply to SPAN:
-
SPAN only supports port-level source interfaces.
The following restrictions apply to ERSPAN and SPAN ACL:
-
Both SPAN and ER-SPAN features cannot be configured on a router simultaneously. Either SPAN or ERSPAN feature can be configured on the same router.
-
The value of ERSPAN session-ID is always zero.
-
IOS XR Command for configuring ERPAN is not available.
-
-
ERSPAN next-hop must have ARP resolved.
-
Any other traffic or protocol will trigger ARP.
-
-
ERSPAN cannot travel over MPLS.
-
Additional routers may encapsulate in MPLS.
-
-
ERSPAN decapsulation is not supported.
-
ERSPAN does not work if the GRE next hop is reachable over sub-interface. For ERSPAN to work, the next hop must be reachable over the main interface.
-
SPAN-ACL is only supported in the Rx direction, that is, in the ingress direction v4 or v6 ACL.
-
MPLS traffic cannot be captured with SPAN-ACL.
-
ACL for any MPLS traffic is not supported.
-