SPAN sources refer to the interfaces from which traffic can be monitored. The Cisco Nexus device supports Ethernet, Fibre Channel, virtual Fibre Channel, port channels, SAN port channels, VSANs and VLANs as SPAN sources. With VLANs or VSANs, all supported interfaces in the specified VLAN or VSAN are included as SPAN sources. You can choose the SPAN traffic in the ingress direction, the egress direction, or both directions for Ethernet, Fibre Channel, and virtual Fibre Channel source interfaces:

• Ingress source (Rx)—Traffic entering the device through this source port is copied to the SPAN destination port.

• Egress source (Tx)—Traffic exiting the device through this source port is copied to the SPAN destination port.

If the SPAN source interface sends more than 6-Gbps traffic or if traffic bursts too much, the device drops traffic on the source interface. You can use the switchport monitor rate-limit 1G command on the SPAN destination to reduce the dropping of actual traffic on the source interface; however, SPAN traffic is restricted to 1 Gbps. For additional information see Configuring the Rate Limit for SPAN Traffic.

On the Cisco Nexus 5548 device, Fibre Channel ports and VSAN ports cannot be configured as ingress source ports in a SPAN session.

A source port, also called a monitored port, is a switched interface that you monitor for network traffic analysis. The switch supports any number of ingress source ports (up to the maximum number of available ports on the switch) and any number of source VLANs.

A source port has these characteristics:

• Can be of Ethernet, port channel, or VLAN port type.

• SPAN sources for VLANs cannot be more than 6 VLANS.

• Without an ACL filter configured, the same source can be configured for multiple sessions as long as either the direction or SPAN destination is different. However, each SPAN RX source should be configured for only one SPAN session with an ACL filter.

• Cannot be a destination port.

• Can be configured with a direction (ingress, egress, or both) to monitor. For VLAN sources, the monitored direction can only be ingress and applies to all physical ports in the group. The RX/TX option is not available for VLAN SPAN sessions.

• Ingress traffic can be filtered by using ACLs so that they mirror only those packets of information that match the ACL criteria.

• Can be in the same or different VLANs.

SPAN destinations refer to the interfaces that monitors source ports. The Cisco Nexus 3600 platform switches support Ethernet interfaces as SPAN destinations.

Each local SPAN session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports, VSANs, or VLANs. A destination port has these characteristics:

• Cannot be a source port.

• Cannot be a port channel or SAN port channel group.

• Does not participate in spanning tree while the SPAN session is active.

• Is excluded from the source list and is not monitored if it belongs to a source VLAN of any SPAN session.

• Receives copies of sent and received traffic for all monitored source ports.

Note	For scale information, see the release-specific Cisco Nexus 3600 NX-OS Verified Scalability Guide.

SPAN has the following guidelines and limitations:

• The same source (ethernet or port-channel) can be a part of multiple sessions. You can configure two monitor session with different destinations, but the same source VLAN is not supported.

• Multiple ACL filters are supported on the same 
source.

• An egress SPAN copy of an access port on Cisco Nexus 3600 platform switch interfaces will always have a dot1q header.

• Configuring two SPAN or ERSPAN sessions on the same source interface with only one filter is not supported. If the same source is used in multiple SPAN or ERSPAN sessions, either all the sessions must have different filters or no sessions should have filters.

• ACL filtering is supported only for Rx SPAN. Tx SPAN mirrors all traffics that egresses at the source interface.

• TCAM carving is not required for SPAN/ERSPAN on Cisco Nexus 3600 platform switches.

• ACL filtering is not supported for IPv6 and MAC ACLs because of ternary content addressable memory (TCAM) width limitations.

• The SPAN TCAM size is 128 or 256, depending on the ASIC. One entry is installed as the default and four are reserved for ERSPAN.

• If the same source is configured in more than one SPAN session, and each session has an ACL filter configured, the source interface is programmed only for the first active SPAN session. Hardware entries programmed for ACEs in other sessions is not included in this source interface.

• Both permit and deny access control entries (ACEs) are treated alike. Packets that match the ACE are mirrored irrespective of whether they have a permit or deny entry in the ACL.

  Note	A deny ACE does not result in a dropped packet. An ACL configured in a SPAN session determines only whether the packet is mirrored or not.

• It is recommended to use only the RX type of source traffic for SPAN to provide better performance because RX traffic is cut-through, whereas TX is store-and-forward. Hence, when monitoring both directions (RX and TX), the performance is not as good as when monitoring only RX. If you need to monitor both directions of traffic, you can monitor RX on more physical ports to capture both sides of the traffic.