[c-nsp] Can a SPAN port kill a router?

[Tim Stevenson]

You are right, input packets on a span port should not be passed into 
the system in IOS - any idea what the traffic spiking the CPU looked like?

Tim

At 10:17 PM 6/21/2006, Hank Nussbacher maintained:
>We have a 7613 with SUP720-3BXL running 12.2(18)SXE5.  We have some SPAN
>ports defined as follows:
>
>monitor session 1 source interface Gi7/1 tx
>monitor session 1 destination interface Gi9/39 , Gi9/41
>monitor session 2 source interface Gi7/1 rx
>monitor session 2 destination interface Gi9/38 , Gi9/40
>
>Last night Gi9/38 (Cisco SCE/Pcube) started flooding the 7613 (CPU util was
>at 100%).  As soon as we removed these 4 monitor commands, the system
>returned to normal.  Does anyone know of an issue with SPAN and data
>*coming* out of the mirror port?  I always thought that the mirror port was
>one-way - data gets sent to it and nothing should ever come back - even if
>the equipment becomes faulty.
>
>Thanks,
>Hank
>
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/



Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Catalyst 6500
Cisco Systems, http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.