[c-nsp] A9K SPAN behavior

[Vitkovský Adam]

Hi Jason,

>  I'm presuming that the invalid
> destination MAC address caused the A9K to drop the packet before it was
> mirrored.  That said, my understanding of SPAN is that a box will always
> mirror the packet before processing it, so I should have seen the packet on
> the A9K span session if this had been the behaviour.  Am I off?

According to the counters. 
MAC Receive Error counter exists on the Punt Switch so invalid MAC might be marked for drop there. 
Packets with the invalid dmac/vlan/encap seem to be dropped at the Medium Access Controller. 
And according to the slides/counters it appears the SPAN operation takes place at the NP. 

8641D-CPU===Punt-Switch===NP===Bridge===FIA===> 
                                                                 | 
                                                               MAC

MAC seems to be hanging of the NP, so it might be MAC acts on the packet before the NP. 
In that case invalids would be dropped before they are SPAN-ed. 

adam

> -----Original Message-----
> From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of
> Jason Lixfeld
> Sent: Tuesday, March 18, 2014 1:03 PM
> To: Cisco NSP
> Subject: [c-nsp] A9K SPAN behavior
> 
> Hi,
> 
> While troubleshooting a reachability problem, I configured a PW SPAN
> session on the upstream A9K (XR 4.3.4 & Trident based SPAN source port)
> but noticed that it didn't actually mirror all traffic.  As a test, I inserted an
> ME3600, in bridge mode, in between the source host and the upstream A9K,
> then did the span on the ingress ME3600 port instead.  At that point, I saw
> the traffic that was missing on the A9K.  Analyzing the missing traffic revealed
> an invalid destination MAC address.  I'm presuming that the invalid
> destination MAC address caused the A9K to drop the packet before it was
> mirrored.  That said, my understanding of SPAN is that a box will always
> mirror the packet before processing it, so I should have seen the packet on
> the A9K span session if this had been the behaviour.  Am I off?
> 
> Thanks!
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/