span sess limit on cisco switches

[spidey07]

This can't be right. It's supposed to support two local span sessions for mirroring traffic but it's only allowing one.

A tech is setting something up and it says "local span session limit exceeded". Nothing fancy, no ERSPAN or RSPAN...just a local session on the switch.

 

[nweaver]

It's 2 RX only ones, not full span, it's one span only (and that depends on Sup and IOS you are running)

If you need to capture much, I would use a 3750, they are MUCH better then the 6505 that is less then one year old.

 

[spidey07]

I'll get right on replacing the core with 3750s.

Sounds like a great idea.

 

[nweaver]

Originally posted by: spidey07
I'll get right on replacing the core with 3750s.

Sounds like a great idea.

I'm not saying to do that, what I'm saying is that for sniffing applications, the 3750 is much more versatile. I have 6+ full speed span ports on my 3750 right now (full speed = 950+Mb/s)

 

[spidey07]

Well the 6500 CAN do two local sessions. There was a service module session that I could not remove and shut down the blade just to test. Just for giggles I spanned all vlans to a single port

LAB6509#sh mon
Session 2
---------
Type : Local Session
Source VLANs :
Both : 1
Destination Ports : Gi2/1


Session 3
---------
Type : Local Session
Source VLANs :
Both : 1-4094
Destination Ports : Gi2/2

 

[p0lar]

What's your SUP engine, and are you running the SFM as well?

 

[spidey07]

sup720/pfc3b

Looks like the WLSM automatically creates a span session, a service module session, to handle wireless multicast traffic. That makes sense given how it handles multicast. Unfortunately it only leaves one span session left.


LAB6509#sh mon
Session 1
---------
Type : Service Module Session
Modules allowed : 1-9
Modules active : 1
BPDUs allowed : Yes


Session 2
---------
Type : Local Session
Source VLANs :
Both : 1
Destination Ports : Gi2/1

 

[p0lar]

Originally posted by: spidey07
sup720/pfc3b

Looks like the WLSM automatically creates a span session, a service module session, to handle wireless multicast traffic. That makes sense given how it handles multicast. Unfortunately it only leaves one span session left.


LAB6509#sh mon
Session 1
---------
Type : Service Module Session
Modules allowed : 1-9
Modules active : 1
BPDUs allowed : Yes


Session 2
---------
Type : Local Session
Source VLANs :
Both : 1
Destination Ports : Gi2/1

I've not run into this, but I don't have that service module either. I suppose for the sake of discussion, I don't have the sup720 either, but this is my personal lab unit at home too, lol. The MSFC2 should have the same SPAN limitations though. Oh well.

 

[spidey07]

msfc isn't involved in span sessions. it's purely the pfc and programming of the ASICs.

 

[p0lar]

Originally posted by: spidey07
msfc isn't involved in span sessions. it's purely the pfc and programming of the ASICs.

Sorry, tank is running on 2 hours of sleep last night... it's a MSFC2/PFC2.

 

[spidey07]

They're completely different daughter cards. So don't list them together when talking about things the PFC does.

Think! Man!

There are differences in what kind of span capabilities you have with a pfc2 vs. pfc3.

 

[p0lar]

Originally posted by: spidey07
They're completely different daughter cards. So don't list them together when talking about things the PFC does.

Think! Man!

There are differences in what kind of span capabilities you have with a pfc2 vs. pfc3.

Hmn.. have to put this on my list of things to look into later as I've not had the need to do any spanning on any production units with the pfc3.

I bought the unit I have (6509 w/dual SUP2/MSFC2/PFC2, SFM, WS-X6608-T1, several PoE 10/100 modules, a MGCP FXS module, and... can't recall what else is collecting dust in a box now) just to model CatOS/IOS version interop issues, as well as for a particular certification track. Its usefulness thereafter has been.. shall we say.. minimally warranted.

I really couldn't justify the sup720 unless I had a particularly fickle client that was on retainer.

Frankly, if I could sell the thing, I probably would. It usually sits not much more active than a boat anchor.