vsp 7200 monitor-by-isid

  • 0
  • 2
  • Question
  • Updated 4 days ago
Running version 6.1.x at the moment on 8 x VSP 7200.

In a Nutshell:
Im testing an IDS solution and configured a monitor-by-isid (with QoS = 3) to copy traffic across the SPB cloud to the IDS. We noticed a massive increase (1ms to 300ms) in ping latency across the core. The config was running what seems to be fine for a few days/weeks before this incident. Unplugging the IDS seems to restore normality. 

I have a suspicion that I might be oversubscribing the core or egress interface, since its ((4 x 10GbE to a single 10GbE egress) x 4) , Mirror Interfaces are normally around 20% utilized, but who knows!? )
 I do not see any indication of loss of packets on the interface side

show khi performance buffer-pool
show khi performance cpu
show khi performance memory
show khi performance process
show khi performance pthread
show khi performance slabinfo
show khi cpp port-statistics
show qos qosq-stats cpu-port

All of these output(s) look normal - as far as I can see since the dates of Hi's does not correspond with the recent impact -  

I thought it might be memory or buffers running low causing this but cannot see it any indication in the stats. 

My Question:
Is there some other parameters I can watch to see drops or performance impact on the mirroring/monitoring side?
Any tips?

Other than this, the SPB core is super stable

Disclaimer - This is my first post. Apologies if I missed or got something wrong. 
Photo of Andre Jordaan

Andre Jordaan

  • 90 Points 75 badge 2x thumb

Posted 4 weeks ago

  • 0
  • 2
Photo of Martin Sebek

Martin Sebek

  • 200 Points 100 badge 2x thumb

I do not have an experience with Fabric RSPAN but I remember we had serious stability issues with VSP 9000 when we were doing long term port mirroring to the hardware probe.  It took us days until we found out what is causing problems.  On the other hand I have never seen such a behaviour on VSP 8000.