Traffic Mirroring Commands

All commands applicable for the Cisco NCS 5500 Series Router are also supported on the Cisco NCS 540 Series Router that is introduced from Cisco IOS XR Release 6.3.2. References to earlier releases in Command History tables apply to only the Cisco NCS 5500 Series Router.

Note:

• Starting with Cisco IOS XR Release 6.6.25, all commands applicable for the Cisco NCS 5500 Series Router are also supported on the Cisco NCS 560 Series Routers.
• Starting with Cisco IOS XR Release 6.3.2, all commands applicable for the Cisco NCS 5500 Series Router are also supported on the Cisco NCS 540 Series Router.
• References to releases before Cisco IOS XR Release 6.3.2 apply to only the Cisco NCS 5500 Series Router.
• Cisco IOS XR Software Release 7.0.1 specific updates are not applicable for the following variants of Cisco NCS 540 Series Routers:
  • N540-28Z4C-SYS-A
  • N540-28Z4C-SYS-D
  • N540X-16Z4G8Q2C-A
  • N540X-16Z4G8Q2C-D
  • N540-12Z20G-SYS-A
  • N540-12Z20G-SYS-D
  • N540X-12Z16G-SYS-A
  • N540X-12Z16G-SYS-D

This module provides command line interface (CLI) commands for configuring traffic monitoring interfaces.

• clear monitor-session counters, on page 3
• destination interface, on page 4
• mirror first, on page 5
• monitor-session, on page 6
• monitor-session (interface), on page 7
• monitor session ERSPAN ACL, on page 9
• show monitor-session status, on page 11

clear monitor-session counters

To clear the traffic mirroring session statistics, use the clear monitor-session counters command in EXEC mode.

clear monitor-session counters [session-name] [interface type interface-path-id]

Syntax Description

Command Default

All stored statistics for all interfaces are cleared.

Command Modes

EXEC

Command History

Usage Guidelines

No specific guidelines impact the use of this command.

Task ID

Examples

This example shows how to clear the traffic mirroring statistic counters:

XR EXEC mode
clear monitor-session mon1 counters

destination interface

To associate a destination interface with a traffic mirroring session, use the destination interface command in monitor session configuration mode. To remove the designated destination, use the no form of this command.

destination interface type interface-path-id
no destination interface type interface-path-id

Syntax Description

Command Default

No default behavior or values

Command Modes

Monitor sessions configuration

Command History

Usage Guidelines

Use the destination interface command to assign a traffic monitoring session to a specific destination interface. This is the port to which a network analyzer is connected. This is generally called the monitoring port.

A destination port has these characteristics:

• A destination port must reside on the same switch as the source port.
• A destination port can be any Ethernet physical port, nV Satellite ICL port, or EFP, but not a bundle interface. Also, the ICL must not be a bundle interface.
• At any one time a destination port can participate in only one traffic mirroring session. A destination port in one traffic mirroring session cannot be a destination port for a second traffic mirroring session. In other words, no two monitor sessions can have the same destination port.
• A destination port cannot also be a source port.

Examples

This example shows how to configure a monitoring port for a traffic mirroring session:

RP/0/RP0/CPU0:router(config)# monitor-session mon1
RP/0/RSP0/CPU0:router(config-mon) # destination interface gigabitethernet0/0/0/15

mirror first

To configure partial traffic mirroring, use the mirror first command in monitor session configuration mode. To stop mirroring a portion of the packet, use the no form of this command.

mirror first bytes

Syntax Description

Command Default

The entire packet is mirrored.

Command Modes

Monitor session configuration

Command History

Usage Guidelines

To mirror the first 64 to 128 bytes of the packet, use the mirror first command. The actual mirrored packet is the configured partial packet monitoring size plus the 4-byte trailing CRC.

Examples

This example shows how to mirror the first 100 bytes of the packet:

RP/0/RP0/CPU0:router(config)# interface gigabitethernet0/0/0/11
RP/0/RP0/CPU0:router(config-if)# monitor-session mon1
RP/0/RP0/CPU0:router(config-if-mon) # mirror first 100

monitor-session

To define a traffic mirroring session and enter monitor session configuration mode, use the monitor-session command in global configuration mode. To remove the traffic mirroring session, use the no form of this command.

monitor-session session-name
no monitor-session session-name

Syntax Description

Command Default

No default behavior or values

Command Modes

Global configuration mode

Command History

Usage Guidelines

Before you can assign a monitor session to a specific interface, you must configure it using the monitor-session command. The session-name should not be the same as any interface name.

In monitor session configuration mode, you should define the destination interface to be used in the traffic mirroring session using the destination command. This commands triggers entry in to the monitor-session sub-mode and creates the session. The session will be non-operable until a destination is configured for the session. The destination can be either IPv4 or IPv6.

Examples

This example shows how to enter monitor session configuration mode:

RP/0/RP0/CPU0:router(config)# monitor-session mon1
RP/0/RP0/CPU0:router(config-mon) #

monitor-session (interface)

To associate a traffic mirroring session with a specific interface, use the monitor-session command in interface configuration mode or dynamic-template configuration mode. To remove the association between a traffic mirroring session and an interface, use the no form of this command.

monitor-session session name ethernetport-level [direction {rx-only | tx-only}]
traffic class {0-7}
discard class {0-7}
no monitor-session session-name port-level [direction {rx-only | tx-only}] [traffic class {0-7}][discard class {0-7}]

Syntax Description

Command Default

Replicates both ingress and egress traffic.

Command Modes

Interface configuration

Command History

Usage Guidelines

Before you can associate a traffic mirroring session to a specific interface, you must define it using the monitor-session global configuration command. After the traffic mirroring session is defined, use the monitor-session interface configuration command to associate this session with a specific source interface. When the session is associated, all specified traffic on the interface is then replicated to the destination location defined in the monitor session configuration. The monitor-session interface configuration command also enters monitor session configuration mode for you to configure additional features of the mirroring session.

Task ID

Examples

This example shows a sample configuration of the monitor-session command in the interface configuration mode:

RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# interface gigabitethernet0/0/0/11
RP/0/RP0/CPU0:router(config-if)# monitor-session mon1 port-level direction rx-only
RP/0/RP0/CPU0:router(config-if-mon)#

monitor session ERSPAN ACL

This command defines a monitor session, and enters monitor session configuration mode.

monitor-session ERSPANethernetdirection{rx-onlyport-levelacl}

Syntax Description

Command Default

No default behavior or values

Command Modes

Route-policy configuration

Command History

Usage Guidelines

Examples

RP/0/RP0/CPU0: pyke-008#sh run monitor-session ERSPAN
monitor-session ERSPAN ethernet
destination interface tunnel-ip1
!
RP/0/RP0/CPU0:pyke-008#sh run int tunnel-ip 1
interface tunnel-ip1
ipv4 address 4.4.4.1 255.255.255.0
tunnel mode gre ipv4

tunnel source 20.1.1.1
tunnel destination 20.1.1.2
!

show monitor-session status

To display status information about configured traffic mirroring sessions, use the show monitor-session status command in XR EXEC mode.

show monitor-session [session-name] status [detail] [errors]

Syntax Description

Command Default

No default behavior or values

Command Modes

XR EXEC mode

Command History

Usage Guidelines

The show monitor-sessions status command displays the following information:

• Destination information for the session (including the name of the interface).
• Destination status (interface state).
• List of source interfaces.
• Any other status information that may be pertinent, such as a software or hardware error that would stop sessions operating correctly. If an error is returned from interactions with another component, then the full error string is only displayed in detail output; standard tabular output reports that there has been an error but refers the user to the detailed output.

Examples

This example shows sample output from the show monitor-session status command:

RP/0/RP0/CPU0:router# show monitor-session status
Monitor-session foo
Destination interface GigabitEthernet 0/0/0/0
Source Interface
==
Gi0/1/0/0.10 Both Operational
Gi0/1/0/0.11 Rx Operational
Gi0/1/0/0.12 Tx Operational

This example shows the sample output for the show monitor-session status detail command:

RP/0/RP0/CPU0: router show monitor-session status detail
Monitor-session foo
Destination interface GigabitEthernet 0/0/0/0
Source Interfaces
GigabitEthernet 0/1/0/0.100:
Direction: Both
Status: Operating
GigabitEthernet 0/2/0/0.200:
Direction: Rx
Status:
Error: <blah>
Monitor session bar
No destination configured
Source Interfaces
GigabitEthernet 0/3/0/0.100:
Direction: Rx
Status:
Not operational (no destination interface)