|
Posted by Chris Cicchetti on November 23, 2004, 5:33 pm
If you were Registered and logged in, you could reply and use other advanced thread options
Hi Konrad,
I have some experience with the SPAN port. My company (Finisar) did
some testing on the technology for the purpose of producing a
whitepaper on analysis via SPAN to promote Cisco's technology and our
analyzers. (http://www.finisar.com/nt/analyze.php) As we are still
negotiating with Cisco about the paper I cannot send it to you yet.
However, I can answer some fundamental questions about the SPAN port.
Below are some pros, cons, and recommendations regarding SPAN that are
not in Cisco's docs.
If you (or anyone else) have questions about SPAN please email me
contact information to the email above. I'll answer you from my work
account. (I use a Yahoo intermediate account so as not to clog my work
email with SPAM from Google.)
I should complete the paper within the next few weeks. Let me know if
you'd like a copy when it's completed. I'd be interested in feedback
as to if the paper helps you.
Chris Cicchetti - Finisar
Pros
•Provides analysis location without breaking links or bringing down
the SAN
•Mirrors all frame data
•Passes Upper-Layer Protocol (ULP) errors
•Provides all data under load in same-rate one-to-one port mirroring
Cons
• Does not mirror link primitives or errors
• Does not pass corrupted frames ( frames with errors)
• Drops frames if input rate exceeds output rate
• Introduces latency
Recommendations
• The SPAN port mirrors data after the switch's Media Access (MAC)
layer. Do not use the SPAN port to debug Link Layer problems.
• The SPAN port will arbitrarily drop traffic under heavy load. Use
the SPAN port for low-capacity situations. Use TAPs inline for other
situations.
• The SPAN port provides no flow control mechanism. Utilize analyzers
that provide full line-rate monitoring.
> Hello all!
>
> Recently I am testing SAN network: two MDS 9216 (system 1.3(6)) and
> two storages IBM FaST 900 (firmware 06.10.06.00).
> I have problem with remote mirroring functionality. When ISL is
> disconnected for a second the storages can not see again anymore
> (until I shut; no shut; one of the ports dedicated for remote mirroring).
>
> I wanted to figure out where the problem lies (who is guilty ;-) ) and debug
> this issue on the FC layer.
> A read "FC Analyzer and SPAN for MDS Switches Configuration Example" but
> another problems with MDS FC capturing showed up:
>
> 1. I do not have PAA (Port Analyzer Adapter) so according to the
> documentation I can not use SPAN functionality.
> I am wondering why MDS can not use mgmt port to encapsulate FC frames
> into Ethernet or GigabitEthernet ports from FC IP card?
>
> 2. I tried to use "fcanlyzer" command to capture traffic between
> switch and devices:
>
> ==
> mds-gorny(config)# fcanalyzer local brief
> Warning: Couldn't obtain netmask info (eth2: no IPv4 address assigned).
> Capturing on eth2
> 0.000000 ff.ff.fd -> ff.ff.fd 0x7a6 0xffff SW_ILS HLO
> ==
>
> What does this warning mean? There is no such interface eth2.
> The interface names eth[0-9] are being used AFAIK only in Linux
> so is there Linux inside?
>
> Then I tried to limit traffic for example to one port but I could not
> find description to "display-filter" option so I entered:
>
> ==
> mds-gorny(config)# fcanalyzer local brief display-filter blabla
> tethereal: Unexpected end of filter string.
> ==
>
> Hmmm so there is [t]Ethereal inside. I found in Ethereal documentation
> what filters I can use. Next I entered:
>
> ==
> mds-gorny(config)# fcanalyzer local brief display-filter fc.d_id==0x020100
> Warning: Couldn't obtain netmask info (eth2: no IPv4 address assigned).
> Capturing on eth2
> ==
>
> But it does not work. There is traffic "from" and "to" FCID 0x020100
> (I can see it without fc.d_id==0x020100) but this command does not show it.
> Why? What is wrong?
>
> 3. I also tried "fcanalyzer remote" but it looks like it does not work at
> all.
>
> 4. Another "funny" thing is that it dumps a core in many situations ;-)
>
> ==
> mds-gorny(config)# fcanalyzer local brief display-filter fc.id==ff.ff.fd
> Segmentation fault - core dumped
> ==
>
> If you have any experiences with capturing FC frames on Cisco MDS please
> share.
>
>
> FUT warning
| 
Yahoo! 
Google 
Windows Live 
del.icio.us 
digg 
Netscape 
XML site map