Configuring SPAN

The Switched Port Analyzer (SPAN) feature (sometimes called port mirroring or port monitoring) selects network traffic for analysis by a network analyzer. The network analyzer can be a Cisco SwitchProbe, a Fibre Channel Analyzer, or other Remote Monitoring (RMON) probes.

This section includes the following topics:

•Information About SPAN Sources

•Information About SPAN Destinations

•Configuring SPAN

•Default SPAN Settings

Information About SPAN Sources

SPAN sources refer to the interfaces from which traffic can be monitored. The Cisco Nexus 5000 Series switch supports Ethernet, virtual Ethernet, Fibre Channel, virtual Fibre Channel, Port Channels, SAN port channels, VLANs, and VSANs as SPAN sources. In the case of VLANs or VSANs, all supported interfaces in the specified VLAN or VSAN are included as SPAN sources. You can choose the SPAN traffic in the ingress direction, the egress direction, or both directions for Ethernet, virtual Ethernet, Fibre Channel, and virtual Fibre Channel source interfaces:

•Ingress source (Rx)—Traffic entering the switch through this source interface is copied to the SPAN destination port.

•Egress source (Tx)—Traffic exiting the switch through this source interface is copied to the SPAN destination port.

Note Device Manager does not support the configuration of Ethernet or virtual Ethernet interfaces as source ports.

Characteristics of Source Ports

A source port, also called a monitored port, is a switched interface that you monitor for network traffic analysis. The switch supports any number of ingress source ports (up to the maximum number of available ports on the switch) and any number of source VLANs or VSANs.

A source port has these characteristics:

•Can be any port type: Ethernet, virtual Ethernet, Fibre Channel, virtual Fibre Channel, Port Channel, SAN-Port Channel, VLAN, and VSAN.

•Cannot be monitored in multiple SPAN sessions.

•Cannot be a destination port.

•Each source port can be configured with a direction (ingress, egress, or both) to monitor. For VLAN, VSAN, Port Channel, and SAN-Port Channel sources, the monitored direction can only be ingress and applies to all physical ports in the group.

•Source ports can be in the same or different VLANs or VSANs.

•For VLAN or VSAN SPAN sources, all active ports in the source VLAN or VSAN are included as source ports.

•The switch supports a maximum of two egress SPAN source ports.

Information About SPAN Destinations

SPAN destinations refer to the interfaces that monitors source interfaces. The Cisco Nexus 5000 Series switch supports Ethernet and Fibre Channel interfaces as SPAN destinations.

Note Device Manager does not support the configuration of Ethernet interfaces as destination ports.

Source SPAN
Dest SPAN

Ethernet

Ethernet

Fibre Channel

Fibre Channel

Fibre Channel

Ethernet (FCoE)

Virtual Ethernet

Ethernet

Virtual Fibre Channel

Fibre Channel

Virtual Fibre Channel

Ethernet (FCoE)


Characteristics of Destination Ports

Each local SPAN session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports, VLANs, or VSANs. A destination port has these characteristics:

•Can be any physical port: Ethernet, Ethernet (FCoE), or Fibre Channel. Virtual Ethernet and virtual Fibre Channel ports cannot be destination ports.

•Cannot be a source port.

•Cannot be a Port Channel or SAN-Port Channel group.

•Does not participate in spanning tree while the SPAN session is active.

•Is excluded from the source list and is not monitored, if it belongs to a source VLAN of any SPAN session.

•Receives copies of sent and received traffic for all monitored source ports. If a destination port is oversubscribed, it can become congested. This congestion can affect traffic forwarding on one or more of the source ports.

Configuring SPAN

You can configure a SPAN session to duplicate packets from source ports to the specified destination ports on the switch. This section includes the following topics:

•Configuring SPAN Using Device Manager

•Creating SPAN Sessions Using Device Manager

•Editing SPAN Sources Using Device Manager

•Deleting SPAN Sessions Using Device Manager

Configuring SPAN Using Device Manager

To monitor network traffic using SD ports, perform this task:

Step 1 Configure the SD port.

Step 2 Attach the SD port to a specific SPAN session.

Step 3 Monitor network traffic by adding source interfaces to the session.

To configure an SD port for SPAN monitoring using Device Manager, perform this task:

Step 1 Right-click the port that you want to configure and click Configure.

You see the general port configuration dialog box.

Step 2 Under Mode, choose SD.

Step 3 Click Apply to accept the change.

Step 4 Close the dialog box.

Creating SPAN Sessions Using Device Manager

To create SPAN sessions using Device Manager, perform this task:

Step 1 Choose Interface > SPAN.

You see the SPAN dialog box.

Step 2 Click the Sessions tab.

Step 3 Click Create.

You see the Create SPAN Sessions dialog box as shown in Figure 20-1.

Figure 20-1 Create SPAN Sessions Dialog Box

Step 4 Choose the session ID (from 1-16) using the up or down arrows and click Create.

Step 5 Repeat Step 4 for each session that you want to create.

Step 6 Enter the destination interface in the Dest Interface field for the appropriate session.

Step 7 Enter the filter VSAN list in the Filter VSAN List field for the appropriate session.

Step 8 Choose active or in active admin status in the Admin drop-down list.

Step 9 Click Apply to save your changes.

Step 10 Close the two dialog boxes.

Editing SPAN Sources Using Device Manager

To edit a SPAN source using Device Manager, perform this task:

Step 1 Choose Interface > SPAN.

You see the SPAN dialog box.

Step 2 Click the Sources tab.

You see the SPAN Sources dialog box as shown in Figure 20-2.

Figure 20-2 SPAN Sources Tab

Step 3 Enter the VSAN list name in the VSAN List field.

Step 4 Click Edit Interface List.

You see the Source Interfaces dialog box.

Step 5 Click Create.

You see the Source Interfaces Interface Sources dialog box as shown in Figure 20-3.

Figure 20-3 Source Interfaces Interface Sources Dialog Box

Step 6 Click the browse button to display the list of available FC ports.

Step 7 Choose a port and click OK.

Step 8 Check the direction (receive or transmit) that you want.

Step 9 Click Create to create the FC interface source.

Step 10 Click Close in each of the three open dialog boxes.

Deleting SPAN Sessions Using Device Manager

To delete a SPAN session using Device Manager, perform this task:

Step 1 Choose Interface > SPAN.

You see the SPAN dialog box.

Step 2 Click the Sessions tab.

Step 3 Click the SPAN session that you want to delete.

Step 4 Click Delete.

The SPAN session is deleted.

Step 5 Close the dialog box.

Default SPAN Settings

Table 20-1 lists the default settings for SPAN parameters.

Table 20-1 Default SPAN Configuration Parameters 

Parameters
Default

SPAN session

Active.

If filters are not specified

SPAN traffic includes traffic through a specific interface from all active VSANs.

Encapsulation

Disabled.

SD port

Output frame format is Fibre Channel.