Nexus 7k Span HTTP traffic

haitham.jneid · ‎11-29-2018

Hi All,

How to span HTTP traffic on Nexus 7K from a layer 3 port-channel subinterface? please share syntax if possible.

thanks,

mojafri · ‎12-03-2018

You can't apply such filters. SPAN is a replica of what you are receiving on source and sending it on destination. You can then further apply filter on wireshark. Below is the guide:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/system-management/guide/b_Cisco_Nexus_7000_Series_NX-OS_System_Management_Configuration_Guide/b_Cisco_Nexus_7000_Series_NX-OS_System_Management_Configuration_Guide_chapter_010100....

Spoiler

Note	
To use a Layer 3 port-channel subinterface as a SPAN source in the monitor session, you must specify the VLAN ID that you entered when configuring IEEE 802.1Q VLAN encapsulation for the subinterface as the filter VLAN. When you use the main interface and the SPAN VLAN filter to filter the 802.1Q VLANs on the subinterfaces, SPAN shows the traffic for all subinterfaces on the SPAN destination port.

When VLANs containing trunk members are configured as SPAN sources, and another set of VLANs are configured as SPAN VLAN filters, then the unwanted traffic from those filter VLANs can be potentially captured

Note To use a Layer 3 port-channel subinterface as a SPAN source in the monitor session, you must specify the VLAN ID that you entered when configuring IEEE 802.1Q VLAN encapsulation for the subinterface as the filter VLAN. When you use the main interface and the SPAN VLAN filter to filter the 802.1Q VLANs on the subinterfaces, SPAN shows the traffic for all subinterfaces on the SPAN destination port. When VLANs containing trunk members are configured as SPAN sources, and another set of VLANs are configured as SPAN VLAN filters, then the unwanted traffic from those filter VLANs can be potentially captured

Regards,

MJ