Hi Jason,
> I'm presuming that the invalid
> destination MAC address caused the A9K to drop the packet before it was
> mirrored. That said, my understanding of SPAN is that a box will always
> mirror the packet before processing it, so I should have seen the packet on
> the A9K span session if this had been the behaviour. Am I off?
According to the counters.
MAC Receive Error counter exists on the Punt Switch so invalid MAC might be
marked for drop there.
Packets with the invalid dmac/vlan/encap seem to be dropped at the Medium
Access Controller.
And according to the slides/counters it appears the SPAN operation takes place
at the NP.
8641D-CPU===Punt-Switch===NP===Bridge===FIA===>
|
MAC
MAC seems to be hanging of the NP, so it might be MAC acts on the packet before
the NP.
In that case invalids would be dropped before they are SPAN-ed.
adam
> -----Original Message-----
> From: cisco-nsp [mailto:[email protected]] On Behalf Of
> Jason Lixfeld
> Sent: Tuesday, March 18, 2014 1:03 PM
> To: Cisco NSP
> Subject: [c-nsp] A9K SPAN behavior
>
> Hi,
>
> While troubleshooting a reachability problem, I configured a PW SPAN
> session on the upstream A9K (XR 4.3.4 & Trident based SPAN source port)
> but noticed that it didn't actually mirror all traffic. As a test, I
> inserted an
> ME3600, in bridge mode, in between the source host and the upstream A9K,
> then did the span on the ingress ME3600 port instead. At that point, I saw
> the traffic that was missing on the A9K. Analyzing the missing traffic
> revealed
> an invalid destination MAC address. I'm presuming that the invalid
> destination MAC address caused the A9K to drop the packet before it was
> mirrored. That said, my understanding of SPAN is that a box will always
> mirror the packet before processing it, so I should have seen the packet on
> the A9K span session if this had been the behaviour. Am I off?
>
> Thanks!
> _______________________________________________
> cisco-nsp mailing list [email protected]
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
