Cisco Nexus 5600 Series - Truncated ERSPAN; ERSPAN with ACL; ERSPAN SPAN on Drop; ERSPAN SPAN-On-Latency

•
Host Interface (HIF) port channels and fabric port channel ports are not supported as SPAN destination
ports.
Truncated ERSPAN
Truncated ERSPAN can be used to reduce the amount of fabric or network bandwidth used in sending ERSPAN
packets.
The default is no truncation so switches or routers receiving large ERSPAN packets might drop these oversized
packets.
Do not enable the truncated ERSPAN feature if the destination ERSPAN router is a Cisco Nexus 6001 or
Cisco Nexus 6004 switch because the Cisco Nexus 6000 Series switch drops these truncated packets.
Note
ERSPAN with ACL
With ERSPAN traffic the destination is remote and the overall impact of bandwidth congestion can be
significant. The ERSPAN with ACL filtering feature allows you to filter ERSPAN traffic so that you can
reduce bandwidth congestion. To configure ERSPAN with ACL filtering, you use ACL’s for the session to
filter out traffic that you do not to span. An ACL is a list of permissions associated to any entity in the system;
in the context of a monitoring session, an ACL is a list of rules which results in the spanning of traffic that
matches the ACL criteria, saving bandwidth for more meaningful data. The filter would apply on all sources
in the session (vlan or interface).
ERSPAN SPAN on Drop
The ERSPAN SPAN-on-drop feature enables the spanning of packets which would normally be dropped due
to unavailable buffer or queue space on ingress. Instead of dropping a packet when congestion occurs, the
system stores the packet in a separate SPAN-on-drop buffer and then sends the packet to the specified
ERSPAN-on-drop destination IP address.
ERSPAN SPAN-on-Latency
The ERSPAN-on-Latency feature allows the system to SPAN packets that exceed a pre-configured latency
threshold.
For high-latency flows the system can be configured to send a copy to any pre-configured SPAN destination.
This creates a data set for analytics that can be used to check which applications are impacted by increased
latency in the network. This feature can also be used to identify traffic flows that experience congestion.
SPAN copies can be transported to a local analyzer port, or remote analyzer using IPFIX/ERSPAN
encapsulation. The SPAN copies can be truncated to save bandwidth.
Note
Cisco Nexus 5600 Series NX-OS System Management Configuration Guide, Release 7.x
196 OL-31641-01
Configuring ERSPAN
Truncated ERSPAN