Process switched traffic

ciscors · ‎08-01-2007

When traffic gets process switched on a 6500 for whatever reason instead of CEF, what would show up in the source/dest MAC address fields? On my 6500, I have a sniffer set up to sniff 15/1 and can see communication between two hosts on different vlan as under:

vlan 5: 5.5.5.5

vlan 6: 6.6.6.6

In the packet capture, I see a packet with these IP/MAC details:

source IP: 5.5.5.5

dest IP: 6.6.6.6

Source MAC: VLAN5 SVI MAC ADDRESS

Dest MAC: MAC address of host 6.6.6.6

Is this normal behavior or should the source MAC have been the MAC address of host 5.5.5.5?

Thank you

Richard Burts · ‎08-01-2007

Rajiv

It sounds to me like normal behavior. In the typical layer 3/routing scenario the end stations builds a frame which has the source IP address as its address, has the destination IP address as the real destination address (and these addresses do not change as the frame gets forwarded), has its own MAC as the source MAC and has its default gateway (the SVI) as the destination MAC. In the process of forwarding the layer 3 device leaves the source and destination IP addresses alone but forwards the frame with its own MAC as the source MAC and the next hop MAC as the destination MAC. It sounds to me like this is what you are describing (with the exception that I would expect the source MAC to be the VLAN 6 MAC and you describe it as the VLAN 5 MAC).

HTH

Rick

HTH

Rick

ciscors · ‎08-02-2007

Rick

thanks for your response. I have another general question about how MLS functions. If there is a packet for a destination which isn?t directly connected to one of the MSFC SVI?s, will it always get process switched?

Does MLS only work for packets that are directly connected to the VLAN interfaces. Hence, what happens when a source is directly connected to vlan2 but the destination is behind a router and the router itself is connected to vlan5. Will those get fast-switched too?

Thx

Richard Burts · ‎08-02-2007

Rajiv

In the 6500 running anywhere near recent code MLS works with CEF (assuming that your configuration has not done something to disable it) and packets for a remote destination are CEF switched (even better than fast switched). There certainly is not anything that limits fast switching to destinations that are locally connected.

HTH

Rick

HTH

Rick

ciscors · ‎08-03-2007

So even packets with a destination for an internet host would be CEF-switched. Right?

I'm facing plenty of problems with packets being process switched on my network and cannot figure out why.