VLAN RX monitor produces RX and TX in sniffer

Unanswered Question
Jun 7th, 2007

I am monitoring one of my VLANs. I use a reflector port to an RSPAN VLAN. The switch is a 3550. When I analyze the resutlts in my sniffer, I notice I am getting both RX/TX for the port in question.

The port has an IP phone connected to it. I dial from a PSTN line in to that phone, and the sniffer shows the 2 way conversation, when I expected to only see the PSTN side (RX) of the conversation. But as I mentioned, I see TX and RX. Why is that? Quite frankly, I prefer RX/TX, but this makes no sense.

Sample of my config:

My sniffer is connected to port fa0/47 on the dest switch. Nothing is connected to Fa0/24 on the monitored switch

Source switch:

IP Phone connected to Fa0/15

interface FastEthernet0/15

switchport access vlan 2

switchport mode access

switchport voice vlan 2

no ip address

duplex full

speed 100

spanning-tree portfast

monitor session 1 source vlan 2 rx

monitor session 1 destination remote vlan 500 reflector-port Fa0/24


interface FastEthernet0/24

switchport mode access

no ip address

spanning-tree portfast

Destination switch:

monitor session 1 destination interface Fa0/47

monitor session 1 source remote vlan 500

interface FastEthernet0/47

switchport access vlan 500

switchport mode access

no ip address

spanning-tree portfast

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
j-block Fri, 06/15/2007 - 10:19

The actual SPAN traffic is carried by the physical port and not the Etherchannel? ON the second switch, do I configure the source as port 23 or should it be ?monitor session 1 source interface port-channel 1"?


This Discussion