Erpan With Udf; Traffic Mirroring Terminology - Cisco 6000 Series Configuration Manual

Configuring Traffic Mirroring
Restrictions
The following are the ERSPAN and SPAN ACL restrictions:
• The maximum number of user-defined fields (UDF) supported in configurations is 8.
• The maximum number of UDF configurations that can be add to access control entries (ACE) is 8.
• The maximum number of bytes involved in a UDF lookup is 16 bytes.
• Remove and re-apply monitor-sessions on all interfaces after modifying the access control list (ACL)
• Only port mode or ACL permit packets will be part of mirroring features.
• The UDF offset depth that can be configured is 64 bytes, beginning from the start of Layer 2 frame.
• GRE features do not support ERSPAN generic routing encapsulation (GRE) encapsulated packets.
• Tunnel statistics are updated in the ingress of ERSPAN packets. When these encapsulated packets are
• Only ERSPAN TYPE II header is supported. The value of the index and session-ID fields are always 0.
• Sequence bit is set in the GRE header and the value of sequence number is always 0 for ERSPAN packets

ERPAN with UDF

ERSPAN with UDF feature enables the device to match on user-defined fields (UDFs) of the outer or inner
packet fields (header or payload) and to send the matching packets to the ERSPAN destination. This feature
helps you to analyze and isolate packet drops in the network.

Traffic Mirroring Terminology

• Ingress Traffic — Traffic that comes into the router.
• Egress Traffic — Traffic that goes out of the router.
• Source (SPAN) interface — An interface that is monitored using the SPAN feature.
• Monitor Session A designation for a collection of SPAN configurations consisting of many source
• Source port—A port that is monitored with the use of traffic mirroring. It is also called a monitored port.
• Destination port—A port that monitors source ports, usually where a network analyzer is connected. It
• Monitor session—A designation for a collection of traffic mirroring configurations consisting of a single
Interface and Hardware Component Configuration Guide for Cisco NCS 6000 Series Routers, IOS XR Release 6.4.x
and UDF
dropped in egress, the tunnel statistics is still updated.
interfaces and a set of destinations.
is also called a monitoring port.
destination and, potentially, many source interfaces.
ERPAN with UDF
97