Traffic Monitoring
Traffic monitoring copies traffic from one or more source ports and sends the copied traffic to a dedicated destination port for analysis by a network analyzer. This feature is also known as Switched Port Analyzer (SPAN).
However, this traffic monitoring is limited to one switch. SPAN can send the traffic between switches, but this traffic cannot be routed. To overcome this problem, support for ERSPAN (Encapsulated Remote Switched Port Analyzer) is provided from Cisco UCS Manager 4.3(4a).
ERSPAN uses GRE encapsulation, which allows you to route SPAN traffic from a source to a destination in the L3 network.
ERSPAN is used to transport mirrored traffic in an IP network. An origin interface will be created on each Fabric Interconnect with a configured source IP address to forward the packets on the L3 network. A unique IP address per fabric is captured along with the VLAN information.
Types of Traffic Monitoring Sessions
There are two types of monitoring sessions:
-
Ethernet
-
Fibre Channel
The type of destination port determines what kind of monitoring session you need. For an Ethernet traffic monitoring session, the destination port must be an unconfigured physical port. For a Fibre Channel traffic monitoring session, the destination port must be a Fibre Channel uplink port except when you are using Cisco UCS 6536 Fabric Interconnect, Cisco UCS 6454 Fabric Interconnect, Cisco UCS 6400 Series Fabric Interconnect and 6300 Series Fabric Interconnects.
![]() Note |
For Cisco UCS 6332, 6332-16UP, 64108, 6454, and 6536 Fabric Interconnects, you cannot choose Fibre Channel destination ports. The destination port must be an unconfigured physical Ethernet port. |
Traffic Monitoring Across Ethernet
An Ethernet traffic monitoring session can monitor any of the following traffic source and destination ports:
Source Ports |
Destination Ports |
---|---|
|
Unconfigured Ethernet Port |
![]() Note |
All traffic sources must be located within the same switch as the destination port. A port configured as a destination port cannot also be configured as a source port. A member port of a port channel cannot be configured individually as a source. If the port channel is configured as a source, all member ports are source ports. |
A server port can be a source, only if it is a non-virtualized rack server adapter-facing port.
Traffic Monitoring for Cisco UCS 6500,6400 Series Fabric Interconnects
-
Cisco UCS 6500, 6400 Series Fabric Interconnects do not support a Fibre Channel port as a destination port. Therefore, an Ethernet port is the only option for configuring any traffic monitoring session on this Fabric Interconnect.
-
Cisco UCS 6500, 6400 Series Fabric Interconnects support monitoring traffic in the transmit direction for more than two sources per Fabric Interconnect.
-
You can monitor or use SPAN on port channels sources for traffic in the transmit and receive directions.
-
You can configure a port as a destination port for only one monitor session.
-
You can monitoring Port-Channel as a source in the transmit direction.
-
You cannot monitor vEth as a source in the transmit direction.
Traffic Monitoring for Cisco UCS 6300 Fabric Interconnects
-
Cisco UCS 6300 Fabric Interconnect supports port-based mirroring.
-
Cisco UCS 6300 Fabric Interconnects support VLAN SPAN only in the receive direction.
-
Ethernet SPAN is port based on the Cisco UCS 6300 Fabric Interconnect.
Traffic Monitoring Across Fibre Channel
You can monitor Fibre Channel traffic using either a Fibre Channel traffic analyzer or an Ethernet traffic analyzer. When Fibre Channel traffic is monitored with an Ethernet traffic monitoring session, at an Ethernet destination port, the destination traffic is FCoE. The Cisco UCS 6300 Fabric Interconnect supports FC SPAN only on the ingress side.
A Fibre Channel traffic monitoring session can monitor any of the following traffic source and destination ports:
Source Ports |
Destination Ports |
---|---|
|
|