[c-nsp] Can a SPAN port kill a router?

Hank Nussbacher hank at efes.iucc.ac.il
Thu Jun 22 01:17:24 EDT 2006


We have a 7613 with SUP720-3BXL running 12.2(18)SXE5.  We have some SPAN 
ports defined as follows:

monitor session 1 source interface Gi7/1 tx
monitor session 1 destination interface Gi9/39 , Gi9/41
monitor session 2 source interface Gi7/1 rx
monitor session 2 destination interface Gi9/38 , Gi9/40

Last night Gi9/38 (Cisco SCE/Pcube) started flooding the 7613 (CPU util was 
at 100%).  As soon as we removed these 4 monitor commands, the system 
returned to normal.  Does anyone know of an issue with SPAN and data 
*coming* out of the mirror port?  I always thought that the mirror port was 
one-way - data gets sent to it and nothing should ever come back - even if 
the equipment becomes faulty.

Thanks,
Hank



More information about the cisco-nsp mailing list