{"id":784,"date":"2013-09-19T18:23:14","date_gmt":"2013-09-20T00:23:14","guid":{"rendered":"http:\/\/benincosa.com\/blog\/?p=784"},"modified":"2014-11-19T11:23:55","modified_gmt":"2014-11-19T17:23:55","slug":"quick-span-with-the-nexus-1000v","status":"publish","type":"post","link":"https:\/\/benincosa.com\/?p=784","title":{"rendered":"Quick SPAN with the Nexus 1000v"},"content":{"rendered":"

Today I thought I’d take a look at creating a SPAN session on the 1000v to monitor traffic. \u00a0I found it really easy to do! \u00a0SPAN is one of those things that takes you longer to read and understand than to actually configure. \u00a0I find that true with a lot of Cisco products: \u00a0Fabric Path, OTV, LISP, etc.<\/p>\n

SPAN is “Switched Port Analyzer”. \u00a0Its basically port monitoring. \u00a0You capture the traffic going from one port and then mirror it on another. \u00a0This is one of the benefits you get out of the box for the 1000v that enables the network administrator not to have this big black box of VMs.<\/p>\n

To follow the guide<\/a>, I installed 3 VMs. \u00a0iperf1, iperf2, and xcat. \u00a0The idea was I wanted to monitor traffic between iperf1 and iperf2 on the xcat virtual machine.<\/p>\n

On the xcat virtual machine I created a new interface and put it in the same VLAN as the other VMs. \u00a0These were all on my port-profile called “VM Network”. \u00a0I created it like this:<\/p>\n

conf
\nvlan 5
\nport-profile type vethernet “VM Network”
\nvmware port-group
\nswitchport mode access
\nswitchport access vlan 510
\nno shutdown
\nstate enabled<\/p><\/blockquote>\n

Then, using vCenter I edited the VMs to assign them to that port group. (Remember: VMware Port-Group = Nexus 1000 Port-Profile)<\/p>\n

On the Nexus 1000v Running the command:<\/p>\n

# sh interface virtual<\/p>\n

——————————————————————————-
\nPort Adapter Owner Mod Host
\n——————————————————————————-
\nVeth1 vmk3 VMware VMkernel 4 192.168.40.101
\nVeth2 vmk3 VMware VMkernel 3 192.168.40.102
\nVeth3 Net Adapter 1 xCAT2 3 192.168.40.102
\nVeth4 Net Adapter 2 iPerf2 3 192.168.40.102
\nVeth5 Net Adapter 3 xCAT 3 192.168.40.102
\nVeth6 Net Adapter 2 iPerf1 3 192.168.40.102<\/p><\/blockquote>\n

Allows me to see which vethernet is assigned to which VM. In this SPAN session, I decided I wanted to monitor the traffic coming out of iPerf1 (Veth6) on the xCAT VM (veth5).
\nNo problem:<\/p>\n

Create The SPAN session<\/strong><\/p>\n

To do this, we just configure a SPAN session:<\/p>\n

n1kv221(config-monitor)# source interface vethernet 6 both
\nn1kv221(config-monitor)# destination interface vethernet 5
\nn1kv221(config-monitor)# no shutdown<\/p><\/blockquote>\n

As you can see from above, I’m monitoring both received and transmitted packets from vethernet 6( iPerf1). Then those packets are being mirrored to vethernet 5 (xCAT). If you have an IP address on xCAT (vethernet 5) you’ll find you can no longer ping it. The port is in span mode. Notice also that by default the monitoring session is off. You have to turn it on.<\/p>\n

Now we want to check things out:<\/p>\n

n1kv221(config-monitor)# sh monitor
\nSession State Reason Description
\n——- ———– ———————- ——————————–
\n1 up The session is up
\nn1kv221(config-monitor)# sh monitor session 1
\nsession 1
\n—————
\ntype : local
\nstate : up
\nsource intf :
\nrx : Veth6
\ntx : Veth6
\nboth : Veth6
\nsource VLANs :
\nrx :
\ntx :
\nboth :
\nsource port-profile :
\nrx :
\ntx :
\nboth :
\nfilter VLANs : filter not specified
\ndestination ports : Veth5
\ndestination port-profile :<\/p><\/blockquote>\n

Now, you’ll probably want to monitor the port right? I just installed wireshark <\/a>on my xcat vm. (Its linux, yum -y install wireshark and ride). To watch from the command line I just ran the command:<\/p>\n

root@xcat ~]# tshark -D
\n1. eth0
\n2. eth1
\n3. eth2
\n4. eth3
\n5. any (Pseudo-device that captures on all interfaces)
\n6. lo<\/p><\/blockquote>\n

This gives me the interfaces. By matching the MAC addresses, I can see that eth2 (or device 3 from the wireshark output) is the one that I have on the Nexus 1000v.<\/p>\n

From here I run:<\/p>\n

[root@xcat ~]# tshark -i 3 -R “eth.dst eq 00:50:56:9C:3B:13”
\n0.000151 192.168.50.151 -> 192.168.50.152 ICMP Echo (ping) reply
\n1.000210 192.168.50.151 -> 192.168.50.152 ICMP Echo (ping) reply
\n2.000100 192.168.50.151 -> 192.168.50.152 ICMP Echo (ping) reply
\n..<\/p><\/blockquote>\n

Then I get a long list of fun stuff to monitor. By pinging between iperf1 and iperf2 I can see all the traffic that goes on. Since there was nothing else on this VLAN it was pretty easy to see. Hopefully this helps me or you troubleshoot down the road.<\/p>\n","protected":false},"excerpt":{"rendered":"

Today I thought I’d take a look at creating a SPAN session on the 1000v to monitor traffic. \u00a0I found it really easy to do! \u00a0SPAN is one of those things that takes you longer to read and understand than to actually configure. \u00a0I find that true with a lot of Cisco products: \u00a0Fabric Path,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[147],"tags":[206,207,205,208],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/posts\/784"}],"collection":[{"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/benincosa.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=784"}],"version-history":[{"count":1,"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/posts\/784\/revisions"}],"predecessor-version":[{"id":785,"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/posts\/784\/revisions\/785"}],"wp:attachment":[{"href":"https:\/\/benincosa.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/benincosa.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/benincosa.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}