- Switch port analyzer (SPAN)
- Inline capture
- Router IP traffic export (RITE)
- Embedded packet capture (EPC)
Switch port analyzer (SPAN)
- source:
- Etherchannel (link, bundle)
- ≠ dst
- destination:
- only 1 SPAN session
- cannot be Etherchannel (neither links nor bundle)
- does not participate in STP, CDP, VTP, DTP, PAgP, LACP
- not captured by SPAN by default
- if port → RSPAN and RSPAN → mirror, then port →× mirror
- does not capture traffic, routed into source VLAN
- copying:
- Rx: before VACL, QoS, policing
- Tx: after VACL, QoS, policing
- ERSPAN ≡ SPAN in GRE
; default – both directions
(config)# monitor session <N> source interface <INTF>
; SRC port sacrifices own resources for SPAN
(config)# monitor session <N> destination interface <INTF> [reflector-port <SRC>]
(config)# monitor session <N> filter vlan <LIST>
; NX-OS, SPAN dst port
(config-if)# switchport monitor
Remote SPAN (RSPAN)
- learning is disabled in RSPAN VLAN
- STP is active in RSPAN VLAN
- only trunks (access ports not supported)
(config-vlan)# remote-span
ERSPAN
(config)# monitor session <N> type erspan-source
(config-mon-erspan-src)# source <INTF>
(config-mon-erspan-src)# no shutdown
(config-mon-erspan-src)# destination
; ID must match on src and dst
(config-mon-erspan-src-dst)# erspan-id <ID>
(config-mon-erspan-src-dst)# ip address <IP>
(config-mon-erspan-src-dst)# origin ip address <SRC_IP>
(config)# monitor session <N> type erspan-destination
(config-mon-erspan-dst)# destination <INTF>
(config-mon-erspan-dst)# no shutdown
(config-mon-erspan-dst)# source
(config-mon-erspan-dst-src)# erspan-id <ID>
(config-mon-erspan-dst-src)# ip address <IP>
; NX-OS, sourcefor ERSPAN packets, any value
(config)# monitor erspan origin ip-address <IP>
ERSPAN II header
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| VLAN | CoS |En |T| Session ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | Index |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Frame /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| CRC |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Version: 0x1
T: truncated, 1 ≡ did not squeeze into MTU
En:
- 00: originally without VLAN tag
- 01: ISL
- 10: 802.1Q
- 11: VLAN tag preserved
ERSPAN III header
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| VLAN | CoS |BSO|T| Session ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Timestamp |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| SGT |P| FT | HWID |D|Gra|O|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+
| Platform ID | | \
+-+-+-+-+-+-+-+ Platform specific info + > optional
| | /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+
\ \
/ Frame /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| CRC |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Version: 0x2
BSO: bad/short/oversize
- 00: good frame
- 01: short frame
- 10: oversized
- 11: CRC/alignment error
P: 1 ≡ Ethernet frame
FT: frame type
- 0: Ethernet
- 1: IP
D: direction, 0 ≡ ingress, 1 ≡ egress
Gra: timestamp granularity
- 00: 100ms
- 01: 100ns
- 10: PTP
- 11: user configured
O: 1 ≡ optional header present
Inline capture
- traffic analyzer is tapped into wire
- disruptive, can affect issue being diagnosed
- captures all frames, including low level primitives
- can detect L1 fault
- expensive
Router IP traffic export (RITE)
- SPAN alternative for routers
(config)# ip traffic-export profile <NAME>
; destination interface forexport
(conf-rite)# interface <INTF>
; collector MAC for Ethernet destination
(conf-rite)# mac-address <MAC>
; inbound default
(conf-rite)# bidirectional
(conf-rite)# incoming access-list <ACL>
(conf-rite)# outgoing access-list <OUT>
(config-if)# ip traffic-export apply <NAME>
Embedded packet capture (EPC)
- mcast: only ingress, does not capture replicated packets
- 1 capture buffer per capture point
- several capture points per interface
# monitor capture buffer <BUFFER> [export <URL>]
# monitor capture buffer <BUFFER> filter <ACL>
; buffer size, 1 MB default
# monitor capture buffer <BUFFER> size <N>
; element size
# monitor capture buffer <BUFFER> max-size <N>
; linear default
# monitor capture buffer <BUFFER> circular|linear
# monitor capture point ip|ipv6 <CAPTURE> <INTF> both|in|out
# monitor capture point associate <CAPTURE> <BUFFER>
# monitor capture point start|stop <CAPTURE>|all
# show monitor capture buffer [dump]
# show monitor capture point
# debug packet-capture