Re: Cisco 9300 SPAN Configuration

TW80CJ5 · ‎07-12-2022

Good Morning Everyone...

I am trying to configure a simple SPAN session on a local switch. I am having problems getting all of the data from the source port to the destination port. I made some comments in the config. I am getting some dribble errors.....See the config below:

SWITCH-01#sh monitor session 56 detail
Session 56
----------
Type : Local Session
Description : -
Source Ports :
RX Only : None
TX Only : None
Both : Gi4/0/41
Source Subinterfaces :
RX Only : None
TX Only : None
Both : None
Source VLANs :
RX Only : None
TX Only : None
Both : None
Source Drop-cause : None
Source EFPs :
RX Only : None
TX Only : None
Both : None
Source RSPAN VLAN : None
Destination Ports : Gi4/0/42
Encapsulation : Native
Ingress : Enabled, default VLAN = 2549
Ingress encap : Untagged
Filter VLANs : 810-2549
Filter SGT : None
Dest RSPAN VLAN : None
IP Access-group : None
MAC Access-group : None
IPv6 Access-group : None
!
!
!
SWITCH-01#sh run int gi4/0/41
Building configuration...
!
Current configuration : 250 bytes
!
interface GigabitEthernet4/0/41
description SPAN SOURCE
switchport trunk allowed vlan 810,811,2501,4610,960,1280,1600,1920,2000,2160,2240,2320,2400
switchport trunk allowed vlan add 2549
switchport mode trunk
ip flow monitor NETFLOW_MONITOR_INPUT input
end
!
!
!
SWITCH-01#sh int gi4/0/41
GigabitEthernet4/0/41 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 7061.xxxx.xxxx (bia 7061.xxxx.xxxx)
Description: SPAN SOURCE
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:07:06, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 7000 bits/sec, 12 packets/sec
77272 packets input, 32148844 bytes, 0 no buffer
Received 3486 broadcasts (184 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 184 multicast, 0 pause input
0 input packets with dribble condition detected *****************************************************************
31445029 packets output, 2766958720 bytes, 0 underruns
Output 10464196 broadcasts (0 multicasts)
0 output errors, 0 collisions, 1 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
!
!
!
!
!
!
!
!

interface GigabitEthernet4/0/42
description SPAN DESTINATION
switchport mode access ************************************(I have toggled this to trunk allowed all)
ip flow monitor NETFLOW_MONITOR_INPUT input
end
!
!
!
SWITCH-01#sh int gi4/0/42
GigabitEthernet4/0/42 is up, line protocol is down (monitoring)
Hardware is Gigabit Ethernet, address is 7061.xxxx.xxxx (bia 7061.xxxx.xxxx)
Description: SPAN DESTINATION
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 10000 bits/sec, 16 packets/sec
9 packets input, 842 bytes, 0 no buffer
Received 9 broadcasts (9 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 9 multicast, 0 pause input
0 input packets with dribble condition detected****************************************************************
31334634 packets output, 2651270714 bytes, 0 underruns
Output 10437142 broadcasts (0 multicasts)
0 output errors, 0 collisions, 1 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

Any information would be greatly appreciated.

balaji.bandi · ‎07-12-2022

that should work.

i will aslo try :

default interface GigabitEthernet4/0/42

no config on the interface just no shut and test.

(good to see your monitor session config also)

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

TW80CJ5 · ‎07-13-2022

Morning BB....I hope you are doing well.

I tried defaulting the interface...still not seeing the amount of information we should...

I also verified port speeds with the source set to auto and destination set to auto. Read somewhere about changing the destination port speed? Going to test setting destination to 100 mbps.

Thoughts / suggestions?

balaji.bandi · ‎07-14-2022

After changing the config, can you post same

config /session output and interface output.

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

RachelGomez161999 · ‎07-14-2022

You can configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of SPAN source ports and VLANs. Both switched and routed ports can be configured as SPAN sources and destinations. You can have multiple destination ports in a SPAN session, but no more than 64 destination ports per device stack.

Regards,

Rachel Gomez

TW80CJ5 · ‎07-14-2022

Team,

Here is the latest config. Still not getting much data when I make the destination port a trunk:

SWITCH-01#sh monitor session 56 DEtail
Session 56
----------
Type : Local Session
Description : -
Source Ports :
RX Only : None
TX Only : None
Both : Gi4/0/41
Source Subinterfaces :
RX Only : None
TX Only : None
Both : None
Source VLANs :
RX Only : None
TX Only : None
Both : None
Source Drop-cause : None
Source EFPs :
RX Only : None
TX Only : None
Both : None
Source RSPAN VLAN : None
Destination Ports : Gi4/0/42
Encapsulation : Native
Ingress : Enabled, default VLAN = 2454
Ingress encap : Untagged
Filter VLANs : 889-2924
Filter SGT : None
Dest RSPAN VLAN : None
IP Access-group : None
MAC Access-group : None
IPv6 Access-group : None

SWITCH-01#sh run int gi4/0/41
Building configuration...

Current configuration : 250 bytes
!
interface GigabitEthernet4/0/41
description SPAN SOURCE
switchport trunk allowed vlan 889,1801,2598,604,961,128,1603,1912,200,2916,2924,2352,2140
switchport trunk allowed vlan add 2454
switchport mode trunk
ip flow monitor NETFLOW_MONITOR_INPUT input
end
!
!
!
!
SWITCH-01#sh int gi4/0/41
GigabitEthernet4/0/41 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is XXXX.XXXX.XXXX (bia XXXX.XXXX.XXXX)
Description: SPAN SOURCE
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:06:36, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 8000 bits/sec, 14 packets/sec
79565 packets input, 32374814 bytes, 0 no buffer
Received 3884 broadcasts (205 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 205 multicast, 0 pause input
0 input packets with dribble condition detected
34858211 packets output, 3636221423 bytes, 0 underruns
Output 11534388 broadcasts (0 multicasts)
0 output errors, 0 collisions, 1 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
!
!
!
SWITCH-01#sh run int gi4/0/42
Building configuration...
!
Current configuration : 62 bytes
!
interface GigabitEthernet4/0/42
switchport mode trunk
end
!
!
SWITCH-01#sh int gi4/0/42
GigabitEthernet4/0/42 is up, line protocol is down (monitoring)
Hardware is Gigabit Ethernet, address is XXXX.XXXX.XXXX (bia XXXX.XXXX.XXXX)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 8000 bits/sec, 13 packets/sec
9 packets input, 842 bytes, 0 no buffer
Received 9 broadcasts (9 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 9 multicast, 0 pause input
0 input packets with dribble condition detected
34712916 packets output, 3501505895 bytes, 0 underruns
Output 11506948 broadcasts (0 multicasts)
0 output errors, 0 collisions, 1 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out