Nexus 7000 span session

[seba]

Hello

We have 2 datacenters witch 2 Nexus 7000 in each one.

Both NX7000 on the same DataCenter have 4x10G links (Channel 1). There's also a VPC betwen DataCenters witch another 4 x 10G links.

NEXUS 1  ----- NEXUS 3

| | | |         \   /     | | | |

| | | |          \ /      | | | |

| | | |          / \      | | | |

| | | |         /    \    | | | |

NEXUS 2 ----- NEXUS 4

The system works fine. But we have suffered twice a severe rate of packet loss that has caused a huge impact.

The only information we have been able to find is a big rate of discarded packets in the interfaces that belogn to ther Inter-DataCenter VPC.

Both times we had just activated a span session on each Nexus 7000:

monitor session 1

  description FLUKE_SPAN

  source vlan 25-26,46,48,50-52,55-56,93-95,98,101,103,109,291,801-802 both

  destination interface Ethernet1/32

Is there any consideration regarding span sessions that we ignore?

We've been working witch Catalyst 6500 for the last 10 years and the Nexus 7000 have been installed only a couple of weeks ago.

[Oleksandr Nesterov]

Hello Seba

I would suggest you to open a service request with TAC to investigate this issue deeper, since there may be many reasons for such behavior.

For example CSCtl06627

HTH,

Alex

[glen.grant]

  Also spanning that many high speed vlans is probably not a good idea either . 

[seba]

Probably it isn't the best idea, but we need it. And it used to work fine with the Catalyst 6500 which is supposed to be quite less powerful.

Thanks

[mikegrous]

Do you have the command Switchport Monitor under int Eth 1/32...

And int eth 1/32 isnt an uplink port is it?

[seba]

interface Ethernet1/32

  description FLUKE SPAN-P5

  switchport monitor

[mikegrous]

If you span only 1 vlan does it still cause issue?

If you span to another device..say a laptop with wireshark.. does it still cause the issue?

[jasonpresnell]

I would agree also that this probably isn't the best idea. I'm assuming the time machine is 10G connected. What is the traffic profile of those VLANs? You also didn't detail which ports are connected to which modules. This smells of ASIC oversubscription to me. You might have just gotten lucky with the Catalyst deployment (or perhaps your traffic profile shifted with the enhanced environment).

Some alternatives you might want to think about:

• Use TAPs on the links you wish to monitor. If your end capture device doesn't have the port density to handle the number of links, think of a packet aggregator from someone like Gigamon or Apcon. You say this is important, the investment may be wise.
• In newer releases of code, you can apply ACL lists to a SPAN session (5.2) or if you want to rearchitect for ERSPAN this can be done in 5.1. If you go with bullet #1, you can do that at the aggregation device. This will allow you to squelch any traffic you are not interested in, taking the burden off the module as well as your capture device. It's equivalent in the catalyst world of an RSPAN+VACL setup.