monitor-session to file

[oeche]

Hello guys,

I have some traffic comming on my port (300 Mbits/s)

I want to capture the traffic to a file.

I'm using this doc :

https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r7-5/interfaces/configuration/guide/b-interfaces-hardware-component-cg-asr9000-75x/b-interfaces-hardware-component-cg-asr9000-71x_chapter_01001.html#Cisco_Concept.dita_c471912c-4ab8...

I should have this output :

Configuring SPAN to File

Use the following command to configure SPAN to File:

monitor-session <name> [ethernet|ipv4|ipv6|mpls-ipv4|mpls-ipv6]
    destination file [size <kbytes>] [buffer-type linear]

but i have only ethernet on my ASR9902 :

RP/0/RP0/CPU0:ASR9902I(config)#monitor-session TEST ?
destination Specify the destination that traffic should be replicated to
ethernet Replicate Ethernet traffic
inject-interface Specify the attachment interface into which traffic may be injected from the SPAN session's destination
mirror Set the mirroring properties of this session

i'm in 7.5.2 on the ASR.

Anyone have an idea why i do not find the ipv4|ipv6|mpls-ipv4|mpls-ipv6] ?

Thanks

[balaji.bandi]

as per i know that is under the interface command :

interface GigabitEthernet 0/0/0/0
    monitor-session <name> [ethernet|ipv4|ipv6|mpls-ipv4|mpls-ipv6]

[oeche]

Same thing under interface :

RP/0/RP0/CPU0:99002(config)#int Te0/0/0/1
RP/0/RP0/CPU0:9902(config-if)#monitor-session TEST ?
acl Enable acl based mirroring
direction Specify the direction of traffic to replicate
drops Enable mirroring of only dropped packets - not yet supported
ethernet Replicate Ethernet traffic
mirror Set the mirroring properties of this interface
port-level Replicate traffic on all interfaces of a main interface

[tkarnani]

the monitor session will show ethernet.

it will capture everything on that interface, ipv4, ipv6, mpls (whatever is enabled)

the only filters we have is to use an ACL for span if the traffic is native ipv4 or ipv6

Thanks

[oeche]

monitor inter Te0/0/0/1

Protocol:General
Interface In(bps) Out(bps) InBytes/Delta OutBytes/Delta
Te0/0/0/1 313.8M/ 3% 0/ 0% 514.3G/85.4M 3.0M/0 

 I have 313M of traffic inbound

Now, look at the counters of the monitor-session

RP/0/RP0/CPU0:9902#show monitor-session TEST counters 
Wed Jan 25 20:59:08.021 CET
Monitor-session TEST
TenGigE0/0/0/1
Rx replicated: 2235 packets, 187152 octets
Tx replicated: 0 packets, 0 octets
Non-replicated: 0 packets, 0 octets

RP/0/RP0/CPU0:9902#show monitor-session TEST counters 
Wed Jan 25 20:59:11.705 CET
Monitor-session TEST
TenGigE0/0/0/1
Rx replicated: 2237 packets, 187280 octets
Tx replicated: 0 packets, 0 octets
Non-replicated: 0 packets, 0 octets

RP/0/RP0/CPU0:9902#show monitor-session TEST counters 
Wed Jan 25 20:59:19.177 CET
Monitor-session TEST
TenGigE0/0/0/1
Rx replicated: 2238 packets, 187344 octets
Tx replicated: 0 packets, 0 octets
Non-replicated: 0 packets, 0 octets

I have only 3 paquet in 20s....

[smilstea]

1. statistics are not real time for SPAN

2. If you are coming from a tagged interface then your mirror port needs to be tagged too or the laptop wont get any of the traffic.

[smilstea]

I think this is an error in the configuration guide. The only option should be ethernet, we either capture the entire packet or not at all, we don't have parsers for mpls ipv4 and mpls ipv6, ipv4, ipv6, etc. A SPAN will capture all traffic on the interface unless you use an ACL which is only for v4 or v6 traffic.

Sam

[oeche]

On the port Te0/0/0/1 of my ASR 9902, i have a 6500 connected on the port Te1/1

On my 6500 i have made a SPAN of a port to the port Te1/1 that is going to my ASR on port Te0/0/0/1.

The SPAN traffic is dot1q traffic.

I receive almost 300Mbit/s of SPAN Traffic.

ON the ASR i made a monitor-session to a file. In the file i only see broadcast or LLDP/CDP corresponding to the my SPAN port.

@smilsteaWhat are you saying, it's that i have to have tagged interface on the ASR ?

[smilstea]

Limitations

SPAN to File has the following limitations:

• Supports only port-level

• VLAN is not supported

• Bundle members are not supported

• Filtering based on Egress ACL is not supported

• Source port statistics is not supported

Sam

[oeche]

@smilstea 

Where do you found this limitation ?

Nothing on the Interface and Hardware Component Configuration Guide for Cisco ASR 9000 Series Routers, IOS XR Release 7.5.x

[smilstea]

It is missing from the documentation, I will open a doc bug to track fixing it. I recommend trying a regular SPAN instead, SPAN to file has many limitations and can drive up your CPU.

Sam

[oeche]

@smilsteaThank for your answer.

Do you think if i put the interface Te0/0/0/1 in l2transport it can change something ?

[smilstea]

The issue is on the mirroring port (in this case the cpu). In traditional SPAN you need to specify the l2transport with a tag (any tag really) just so that tagged traffic will get mirrored. Otherwise in a traditional SPAN you would see the same behavior where dot1q traffic is not spanned. In this case we have no way to tag the interface going to the CPU / CPU itself so the traffic gets dropped as its on the wrong VLAN going to the CPU.

[oeche]

is there a hope that in futur version it will be possible ?

[smilstea]

I believe this is a limitation of cpu architecture