[c-nsp] ERSPAN

[Geyer, Nick]

Hi Peter,

Definitely did a no shutdown on the session and it was showing as up.
When the interface is in a monitoring state, I assume the interface
counters still increment as per normal? Was getting 0pps on the
destination interface, but the source interface was doing ~550pps.

Will also try Patrick's suggestion of setting the IP on the destination
switch to its own loopback rather than the sources loopback.

Thanks,
Nick 


-----Original Message-----
From: Peter Rathlev [mailto:peter at rathlev.dk] 
Sent: Tuesday, 8 April 2008 9:09 AM
To: Geyer, Nick
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] ERSPAN

Hi Nick,

Just a shot in the dark, but did you remember the "no shutdown" command
under the monitor configuration? The start in admin disabled state.

We have no problems running ERSPAN. You need supervisor HW version 3.2
(IIRC) by the way. We have some 3 year old cards that are HW version
2.1, and they won't do it. A "show module" can tell you the version. Too
low version and the CLI tells you "hardware disabled" when you try to
"no shut" the session.

Regards,
Peter

On Tue, 2008-04-08 at 08:54 +1000, Geyer, Nick wrote:
> Hi Everyone,
> 
> Just a few quick questions regarding ERSPAN and Wireshark. I have a
lab
> setup to test this functionality out (two 6509E's with Sup720-3B,
> 12.2(18)SXF11) however with a laptop connected to the destination
mirror
> port with Wireshark running, I was unable to see any traffic. Just
> hoping someone may be able to provide a few pointers as to where I
went
> wrong (since I am unable to find many real world example
> configurations).
> 
>  
> 
> SWITCH-A has a Loopback address of 192.168.100.1/32 and
> GigabitEthernet1/47 (source port) is an access port, part of Vlan101.
> SWITCH-B has a Loopback address of 192.168.200.1/32 (routed network in
> the middle with several hops).
> 
>  
> 
> SWITCH-A Configuration:
> 
> monitor session 1 type erspan-source
> 
>  source interface GigabitEthernet1/47
> 
>  destination
> 
>   ip address 192.168.200.1
> 
>   origin ip address 192.168.100.1
> 
>   erspan-id 1
> 
>  
> 
> SWITCH-B Configuration
> 
>  monitor session 1 type erspan-destination
> 
>   destination interface GigabitEthernet1/25
> 
>   source
> 
>    ip address 192.168.100.1
> 
>    erspan-id 1
> 
>  
> 
> Doing a 'show monitor detail' shows that switch-a is monitoring both
rx
> and tx on port Gi1/47 and sending the data to 192.168.200.1. The same
> command on switch-b shows that the source is 192.168.100.1 and it is
> mirroring to port Gi1/25. Doing a 'show interface Gi1/25' shows that
the
> port is up but line protocol is in a down (monitoring) state.
> 
>  
> 
> If anyone can she any extra light on more configuration needed, or if
> Wireshark etc needs to be setup in a certain way it would be much
> appreciated.
> 
>  
> 
> Cheers,
> 
>  
> 
> Nick.
> 
>  
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/