Traffic incoming missing in span port with EX leaves

[henryiron]

I am debugging the traffic between 2 VM using SPAN ports. I configured source groups and destinations groups for the leaves involved. In each leaf there is a physical span port that send the traffic to a traffic aggregator, then it forwards the traffic to a probe.

Using the probe we are able to see the traffic captured, but we do not get the traffic in both direction: we capture only the traffic outgoing.
I tried changing the "Direction" field ("Both", "Incoming", "Outgoing") and the type of the source port ("None" and "EPG").
But the probe see only the traffic outgoing. If I select "Incoming", I capture no traffic. We tried also with ERSPAN using another probe compatible with this protocol, but the result is the same: we see only the traffing ougoing from the interface (we see only the echo reply). The leaves involved are 93180EX and the APIC version is 3.2(3o).

Can anyone use the span ports in both direction successfully?

[henryiron · Accepted solution]

With the support of TAC, we found that the problem was caused by PTP protocol: 8 bytes inserted in the ERSPAN header that caused them to be dropped and not recognised, while for the SPAN it is likely the upgrade to 4.2 fixed something broken.