The Switched Port Analyzer (SPAN) feature (sometimes called port mirroring or port monitoring) selects network traffic for analysis by a network analyzer. The network analyzer can be a Cisco SwitchProbe, a Fibre Channel Analyzer, or other Remote Monitoring (RMON) probes.
SPAN sources refer to the interfaces from which traffic can be monitored. The
Cisco Nexus 5000 Series switch supports Ethernet, Fibre Channel, virtual Fibre Channel, port channels, SAN port channels, VLANs, and VSANs as SPAN sources. With VLANs or VSANs, all supported interfaces in the specified VLAN or VSAN are included as SPAN sources. You can choose the SPAN traffic in the ingress direction, the egress direction, or both directions for Ethernet, Fibre Channel, and virtual Fibre Channel source interfaces:
Ingress source (Rx)—Traffic entering the switch through this source port is copied to the SPAN
destination port.
Egress source (Tx)—Traffic exiting the switch through this source port is copied to the SPAN destination port.
A source port, also called a monitored port, is a switched interface that you monitor for network traffic analysis. The switch supports any number of ingress source ports (up to the maximum number of available ports on the switch) and any number of source VLANs or VSANs.
A source port has these characteristics:
Can be of any port type: Ethernet, Fibre Channel, virtual Fibre Channel, port channel, SAN port channel, VLAN, and VSAN.
Cannot be monitored in multiple SPAN sessions.
Cannot be a destination port.
Each source port can be configured with a direction (ingress, egress, or both) to monitor. For VLAN, VSAN, port channel, and SAN port channel sources, the monitored direction can only be ingress and applies to all physical ports in the group. The rx/tx option is not available for VLAN or VSAN SPAN sessions.
Source ports can be in the same or different VLANs or VSANs.
For VLAN or VSAN SPAN sources, all active ports in the source VLAN or VSAN are included as source ports.
The switch supports a maximum of two egress SPAN source ports.
SPAN Destinations
SPAN destinations refer to the interfaces that monitors source ports. The
Cisco Nexus 5000 Series switch supports Ethernet and Fibre Channel interfaces as SPAN destinations.
Each local SPAN session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports, VLANs, or VSANs. A destination port has these characteristics:
Can be any physical port, Ethernet, Ethernet (FCoE), or Fibre Channel, and virtual Fibre Channel ports cannot be destination ports.
Cannot be a source port.
Cannot be a port channel or SAN port channel group.
Does not participate in spanning tree while the SPAN session is active.
Is excluded from the source list and is not monitored if it belongs to a source VLAN of any SPAN session.
Receives copies of sent and received traffic for all monitored source ports. If a destination port is oversubscribed, it can become congested. This congestion can affect traffic forwarding on one or more of the source ports.
Configuring SPAN
Creating and Deleting a SPAN Session
You create a SPAN session by assigning a session number using the
monitor command. If the session already exists, any additional configuration is
added to that session.
Procedure
Command or Action
Purpose
Step 1
switch#
configure terminal
Enters configuration mode.
Step 2
switch(config)#
monitor sessionsession-number
Enters the monitor configuration mode. New session configuration
is added to the existing session configuration.
Configuring the Destination Port
Configuring an Ethernet Destination Port
Note
The SPAN destination port can only be a physical port on the switch.
You can configure an Ethernet interface as a SPAN destination port.
Procedure
Command or Action
Purpose
Step 1
switch#
configure terminal
Enters configuration mode.
Step 2
switch(config)#
interface ethernetslot/port
Enters interface configuration mode for the specified Ethernet
interface selected by the slot and port values.
Step 3
switch(config-if)#
switchport monitor
Sets the interface to monitor mode. Priority flow control is
disabled when the port is configured as a SPAN destination.
Configures sources and the traffic direction in which to duplicate
packets. You can enter a range of Ethernet, Fibre Channel, or virtual Fibre
Channel ports. You can specify the traffic direction to duplicate as ingress
(rx), egress (tx), or both. By default, the direction is both.
The following example shows configuring an Ethernet SPAN source port:
The following example shows configuring a Fibre Channel SPAN source
port:
switch(config-monitor)# source interface fc 2/1
The following example shows configuring a virtual Fibre Channel SPAN
source port:
switch(config-monitor)# source interface vfc 129
Configuring Source Port Channels, VLANs, or VSANs
You can configure the source channels for a SPAN session. These ports
can be port channels, SAN port channels, VLANs, and VSANs. The monitored
direction can only be ingress and applies to all physical ports in the group.
Configures port channel, SAN port channel, VLAN, or VSAN sources.
The monitored direction can only be ingress and applies to all physical ports
in the group. For VLAN or VSAN sources, the monitored direction is implicit.
The following example shows configuring a port channel SPAN source:
Suspends the specified SPAN session or all sessions.
The following example shows suspending a SPAN session:
switch(config)# monitor session 3 shut
Note
The
Cisco Nexus 5000 Series switch supports two
active SPAN sessions. When you configure more than two SPAN sessions, the first
two sessions are active. During startup, the order of active sessions is
reversed; the last two sessions are active. For example, if you configured ten
sessions 1 to 10 where 1 and 2 are active, after a reboot, sessions 9 and 10
will be active. To enable deterministic behavior, explicitly suspend the
sessions 3 to 10 with the
monitor sessionsession-numbershut command.
Displaying SPAN Information
To display SPAN information, perform this task:
Procedure
Command or Action
Purpose
Step 1
switch# show monitor [session {all | session-number | rangesession-range} [brief]]
Displays the SPAN configuration.
This example shows how to display SPAN session information: