cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
369
Views
0
Helpful
3
Replies

Port Mirroring/SPAN Not Working

acwilliams
Level 1
Level 1

We're trying to setup port mirroring from 1 port to another destination but are unable to get it working. Initially it was working but then randomly stopped with no changes. Since then any network configuration changes including rebooting the switches has been unsuccessful at getting the mirroring back online.

Below is out configuration on the switch.

interface GigabitEthernet2/0/34
!
interface GigabitEthernet2/0/35
!
interface GigabitEthernet2/0/40
description Tunstall Voice
switchport access vlan 90
switchport mode access
spanning-tree portfast
!
monitor session 1 source interface Gi2/0/40
monitor session 1 destination interface Gi2/0/34
monitor session 2 source interface Gi2/0/40
monitor session 2 destination interface Gi2/0/35

I've also tried configuration with ingress vlan specified and that allows traffic to the destination but still no mirrored traffic.

I've also attached the interface details that show that the data flow through the destination matches the source but there is no traffic on the destination.

NZSWC01#show interfaces gi2/0/34
GigabitEthernet2/0/34 is up, line protocol is down (monitoring)
Hardware is Gigabit Ethernet, address is 6c29.d26c.f222 (bia 6c29.d26c.f222)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 01:03:05, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 1273000 bits/sec, 732 packets/sec
3 packets input, 250 bytes, 0 no buffer
Received 1 broadcasts (1 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 1 multicast, 0 pause input
0 input packets with dribble condition detected
1587433 packets output, 347112940 bytes, 0 underruns
Output 0 broadcasts (1970 multicasts)
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

NZSWC01#show interfaces gi2/0/40
GigabitEthernet2/0/40 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 6c29.d26c.f228 (bia 6c29.d26c.f228)
Description: Tunstall Voice
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 01:03:27, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 644000 bits/sec, 371 packets/sec
5 minute output rate 638000 bits/sec, 369 packets/sec
800570 packets input, 175615947 bytes, 0 no buffer
Received 5 broadcasts (2 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 2 multicast, 0 pause input
0 input packets with dribble condition detected
796217 packets output, 173534296 bytes, 0 underruns
Output 1 broadcasts (1986 multicasts)
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

3 Replies 3

AshSe
VIP
VIP

Hi @acwilliams 

Below are some troubleshooting steps:

  1. Simplify the SPAN configuration to a single session.
  2. Test with a different destination port.
  3. Check for software bugs or limitations in the switch documentation.
  4. Verify that the expected traffic is present on the source port.
  5. Check logs and debug output for additional clues.

Feel free if you need more details on how to tshoot.

Hope this will help!

AshSe

Hi,

The monitor session 1 came good on the host after it was shutdown for a time (not sure the exact period).

Monitor session 2 is still broken including after a server shutdown however it is running in a VM so might need the hypervisor host to also be shutdown. Not sure if this is expected behaviour though.

I'd tested with different source and destination ports yesterday with no difference in behaviour.

Could you provide more information on how to get the log and debug output for further troubleshooting if we require it.

Regards, Andrew

M02@rt37
VIP
VIP

Hello @acwilliams 

Same symptom with only one monitor session configured ?

 

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.