Today I thought I'd take a look at creating a SPAN session on the 1000v to monitor traffic. I found it really easy to do! SPAN is one of those things that takes you longer to read and understand than to actually configure. I find that true with a lot of Cisco products: Fabric Path, OTV, LISP, etc.
SPAN is "Switched Port Analyzer". Its basically port monitoring. You capture the traffic going from one port and then mirror it on another. This is one of the benefits you get out of the box for the 1000v that enables the network administrator not to have this big black box of VMs.
To follow the
guide, I installed 3 VMs. iperf1, iperf2, and xcat. The idea was I wanted to monitor traffic between iperf1 and iperf2 on the xcat virtual machine.
On the xcat virtual machine I created a new interface and put it in the same VLAN as the other VMs. These were all on my port-profile called "VM Network". I created it like this:
conf
vlan 5
port-profile type vethernet "VM Network"
vmware port-group
switchport mode access
switchport access vlan 510
no shutdown
state enabled
Then, using vCenter I edited the VMs to assign them to that port group. (Remember: VMware Port-Group = Nexus 1000 Port-Profile)
On the Nexus 1000v Running the command:
# sh interface virtual
-------------------------------------------------------------------------------
Port Adapter Owner Mod Host
-------------------------------------------------------------------------------
Veth1 vmk3 VMware VMkernel 4 192.168.40.101
Veth2 vmk3 VMware VMkernel 3 192.168.40.102
Veth3 Net Adapter 1 xCAT2 3 192.168.40.102
Veth4 Net Adapter 2 iPerf2 3 192.168.40.102
Veth5 Net Adapter 3 xCAT 3 192.168.40.102
Veth6 Net Adapter 2 iPerf1 3 192.168.40.102
Allows me to see which vethernet is assigned to which VM. In this SPAN session, I decided I wanted to monitor the traffic coming out of iPerf1 (Veth6) on the xCAT VM (veth5).
No problem:
Create The SPAN session
To do this, we just configure a SPAN session:
n1kv221(config-monitor)# source interface vethernet 6 both
n1kv221(config-monitor)# destination interface vethernet 5
n1kv221(config-monitor)# no shutdown
As you can see from above, I'm monitoring both received and transmitted packets from vethernet 6( iPerf1). Then those packets are being mirrored to vethernet 5 (xCAT). If you have an IP address on xCAT (vethernet 5) you'll find you can no longer ping it. The port is in span mode. Notice also that by default the monitoring session is off. You have to turn it on.
Now we want to check things out:
n1kv221(config-monitor)# sh monitor
Session State Reason Description
------- ----------- ---------------------- --------------------------------
1 up The session is up
n1kv221(config-monitor)# sh monitor session 1
session 1
---------------
type : local
state : up
source intf :
rx : Veth6
tx : Veth6
both : Veth6
source VLANs :
rx :
tx :
both :
source port-profile :
rx :
tx :
both :
filter VLANs : filter not specified
destination ports : Veth5
destination port-profile :
Now, you'll probably want to monitor the port right? I just installed
wireshark on my xcat vm. (Its linux, yum -y install wireshark and ride). To watch from the command line I just ran the command:
root@xcat ~]# tshark -D
1. eth0
2. eth1
3. eth2
4. eth3
5. any (Pseudo-device that captures on all interfaces)
6. lo
This gives me the interfaces. By matching the MAC addresses, I can see that eth2 (or device 3 from the wireshark output) is the one that I have on the Nexus 1000v.
From here I run:
[root@xcat ~]# tshark -i 3 -R "eth.dst eq 00:50:56:9C:3B:13"
0.000151 192.168.50.151 -> 192.168.50.152 ICMP Echo (ping) reply
1.000210 192.168.50.151 -> 192.168.50.152 ICMP Echo (ping) reply
2.000100 192.168.50.151 -> 192.168.50.152 ICMP Echo (ping) reply
..
Then I get a long list of fun stuff to monitor. By pinging between iperf1 and iperf2 I can see all the traffic that goes on. Since there was nothing else on this VLAN it was pretty easy to see. Hopefully this helps me or you troubleshoot down the road.