Switched Port Analyzer (SPAN), which is also called port mirroring, or traffic mirroring enables you to monitor network traffic passing in, or out of, a set of ports. You can then pass this traffic to a destination port on the same router.

Traffic mirroring copies traffic from one or more source ports and sends the copied traffic to one or more destinations for analysis by a network analyzer or other monitoring device. However, traffic from one source port can be copied to only one destination port. Traffic mirroring does not affect the flow of traffic on the source ports, and allows the mirrored traffic to be sent to a destination port.

For example, you need to attach a traffic analyzer to the router if you want to capture Ethernet traffic that is sent by host A to host B. Traffic between host A and host B is also seen on the destination port.

When local traffic mirroring is enabled, the traffic analyzer is attached directly to the port of the same router that is configured to receive a copy of every packet that host A sends. This port is called a traffic mirroring port. The other sections of this document describe how you can fine tune this feature.

These are the supported traffic mirroring types.

• Local SPAN

• Layer 2 or Layer 3 traffic mirroring: Both Layer 2 and Layer 3 source ports can be mirrored.

• ACL-based SPAN

• ERSPAN

• File Mirroring

• A maximum of 100 source ports/L2 subinterfaces per session are supported.

• Egress mirroring is supported on best effort basis. All the changes made to the source packets may not be reflected in the mirrored packets at the destination port.

• A maximum of up to four sessions are supported, based on the source interface directions.

The following task describes how to configure local traffic mirroring with physical ports used as the source port.

Note	For physical ports, you must configure the port-level option of the monitor-session test direction rx-only port-level command.

Router# configure 
Router(config)# monitor-session mon1
Router(config-mon)# destination interface HundredGigE0/1/0/15
Router(config-mon)# exit
Router(config)# interface HundredGigE 0/1/0/1
Router(config-if)# monitor-session mon1 port-level direction rx-only
Router(config-if)# commit

The following task describes how to configure local traffic mirroring with L2 sub-interface used as the source port.

Router(config)# interface tenGigE 0/0/0/0.1 l2transport 
Router(config-subif)# encapsulation dot1q 1000
Router(config-subif)# monitor-session test direction rx-only 
Router(config-if-mon)# commit

Router# show monitor-session status
Monitor-session ms1
Destination interface HundredGigE0/0/1/2
================================================================================
Source Interface      Dir   Status
--------------------- ----  ----------------------------------------------------
Hu0/0/1/3.100         Rx    Operational
Gi0/0/0/5 (port)      Both  Operational
Hu0/0/1/3 (port)      Both  Operational

Router# show monitor-session status detail
Monitor-session ms1
  Destination interface HundredGigE0/0/1/2
  Source Interfaces
  -----------------
  HundredGigE0/0/1/3.100
    Direction:  Rx-only
    Port level: False
    ACL match:  Disabled
    Portion:    Full packet
    Interval:   Mirror all packets
    Status:     Operational
  GigabitEthernet0/0/0/5
    Direction:  Both
    Port level: True
    ACL match:  Disabled
    Portion:    Full packet
    Interval:   Mirror all packets
    Status:     Operational
  HundredGigE0/0/1/3
    Direction:  Both
    Port level: True
    ACL match:  Disabled
    Portion:    Full packet
    Interval:   Mirror all packets
    Status:     Operational

Router# show monitor-session status error
Monitor-session ms1
Destination interface HundredGigE0/0/1/2
================================================================================
Source Interface      Dir   Status
--------------------- ----  ----------------------------------------------------

• Ingress Traffic — Traffic that comes into the router.

• Egress Traffic — Traffic that goes out of the router.

• Source port—A port that is monitored with the use of traffic mirroring. It is also called a monitored port.

• Destination port—A port that monitors source ports, usually where a network analyzer is connected. It is also called a monitoring port.

• Monitor session—A designation for a collection of SPAN configurations consisting of a single destination and, potentially, one or many source ports.

A source port, also called a monitored port, is a routed port that you monitor for network traffic analysis. In a single traffic mirroring session, you can monitor source port traffic. The routers support a maximum of up to 800 source ports.

A source port, also called a monitored port, is a routed port that you monitor for network traffic analysis. In a single traffic mirroring session, you can monitor source port traffic. The NCS 5000 Series Routers support a maximum of up to 100 source ports.

A source port has these characteristics:

• Physical ports are supported. It can be any data port type, such as 100 Gigabit Ethernet or 10 Gigabit Ethernet.

• L2 sub-interfaces can be configured as source ports.

• Each source port can be monitored in only one traffic mirroring session.

• When a port is used as a source port, the same port cannot be used as a destination port.

• Each source port can be configured with a direction (ingress, egress, or both) to monitor for local traffic mirroring.

A monitor session is a collection of traffic mirroring configurations consisting of a single destination and, potentially, many source interfaces. For any given monitor session, the traffic from the source interfaces (called source ports) is sent to the monitoring port or destination port. If there are more than one source port in a monitoring session, the traffic from the several mirrored traffic streams is combined at the destination port. The result is that the traffic that comes out of the destination port is a combination of the traffic from one or more source ports.

Monitor sessions have these characteristics:

• A single monitor session can have only one destination port.

• A single destination port can belong to only one monitor session.

• A monitor session can have a maximum of 100 source ports.

Each session must have a destination port or file that receives a copy of the traffic from the source ports.

A destination port has these characteristics:

• A destination port cannot be a source port.

• A destination port must reside on the same router as the source port for local traffic mirroring.

• For remote mirroring, the destination is a GRE tunnel.

• A destination port for local mirroring can be any Ethernet physical port. It can be a Layer 2 or Layer 3 transport interface.

• At any time, a destination port can participate in only one traffic mirroring session. 
A destination port in one traffic mirroring session cannot be a destination port for a second traffic mirroring session. In other words, no two monitor sessions can have the same destination port.