cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
301
Views
0
Helpful
1
Replies

Discrepancy between input and output rates on SPAN interfaces

dbsga
Level 1
Level 1

Hi,

Just trying to understand why there is a consistent ~50% discrepancy between the input data rate of the SPAN source interface and the output data rate of the SPAN destination interface?

Input/output rates seem to align for another monitor session running on the same switch.

Any insight would be greatly appreciated! Thanks.

Interface statistics shown below.

IE-4010-16S12P :  15.2(6)E1

Session 2
---------
Type : Local Session
Source Ports :
RX Only : Gi1/18
Destination Ports : Gi1/5
Encapsulation : Replicate
Ingress : Disabled

GigabitEthernet1/18 is up, line protocol is up (connected)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 23/255
Encapsulation ARPA, loopback not set
Keepalive not set
Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseLX SFP
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
30 second input rate 91800000 bits/sec, 67763 packets/sec
30 second output rate 0 bits/sec, 0 packets/sec
9514123310 packets input, 1258153953541 bytes, 0 no buffer
Received 24381626 broadcasts (18445610 multicasts)
1 runts, 0 giants, 0 throttles
4 input errors, 3 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 18445610 multicast, 0 pause input
0 input packets with dribble condition detected
371296 packets output, 29977348 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
19721 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

GigabitEthernet1/5 is up, line protocol is down (monitoring)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 12/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 1d17h, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
30 second input rate 0 bits/sec, 0 packets/sec
30 second output rate 49269000 bits/sec, 63367 packets/sec
218 packets input, 47131 bytes, 0 no buffer
Received 218 broadcasts (172 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 172 multicast, 0 pause input
0 input packets with dribble condition detected
9100945063 packets output, 864557186870 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

1 Reply 1

andrewswanson
Level 7
Level 7

From the Cisco Documentation:

https://www.cisco.com/c/en/us/td/docs/switches/lan/cisco_ie4010/software/release/15-2_4_EC/configuration/guide/scg-ie4010_5000/swspan.html

 

Multicast traffic can be monitored. For egress and ingress port monitoring, only a single unedited packet is sent to the SPAN destination port. It does not reflect the number of times the multicast packet is sent.

Does the other SPAN session (with similar i/o rates) have the same level of multicast?

hth
Andy

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card