Erspan - Cisco 6000 Series Configuration Manual

ERSPAN

Figure 1: Traffic Mirroring Operation
When local traffic mirroring is enabled, the traffic analyzer is attached directly to the port that is configured
to receive a copy of every packet that host A sends. This port is called a traffic mirroring port. The other
sections of this document describe how you can fine tune this feature.
ERSPAN
Encapsulated Remote Switched Port Analyzer (ERSPAN) mirrors traffic on one or more source ports and
delivers the mirrored traffic to destination port on another switch or management server.
ERSPAN enables network operators to troubleshoot issues in the network in real-time using automated tools
that auto-configures ERSPAN parameters on the network devices to send specific flows to management
servers for in-depth analysis.
ERSPAN transports mirrored traffic over an IP network. The traffic is encapsulated at the source router and
is transferred across the network. The packet is decapsulated at the destination router and then sent to the
destination analyzer.
Supported Capabilities
The following capabilities are supported:
• Layer 3 interfaces, such as physical, and bundle interfaces or sub-interface, can be source interfaces.
• ERSPAN with GRE IPv4 has tunnel destinations.
• ERPSAN supports only RX direction
• One destination interface is allowed per monitor session.
• Only port mode or ACL permit packets are part of mirroring features.
• Full packet capture is supported.
• MPLS protocols are supported only with IPv4 unicast routing.
• To limit the amount of bandwidth used for SPAN, a static policer is applied before sending out the
Interface and Hardware Component Configuration Guide for Cisco NCS 6000 Series Routers, IOS XR Release 6.4.x
96
SPAN-replicated packet. There will be one policer for all the SPAN packets on RX source. Initially, the
policing rate is set to 1Gbps per Network Processor Unit (NPU).
Configuring Traffic Mirroring