Hi Dennis,

Do you mean that you see retransmissions of the CSS keepalives? What kind of keepalives are you using? TCP or HTTP?

Also how are you spanning? I would not expect to see retransmissions on keepalives, but before analyzing that in more detail, can you double check that these are "real" retransmissions.

We see this all the time with sniffer traces that spanned captures.

Basically, when you span a vlan there are two sides to that vlan; Incoming and outgoing.

If you are spanning the vlan, the packet will appear twice, once when it goes in, once when it goes out. Ethereal/Sniffer Pro/Wireshark cannot discern these types of packets from any other. They are actually quite dumb in how they determine a retransmission (they just look for a packet with the same data.) If I personally receieve a trace, the only way to tell is to filter out a specific conversation and look at the delta between the packets. Notice in most of your traces its roughly .000016 seconds. If this was a true re-transmission, I would expect to see the delta at about 3 seconds. If you change the span on the vlan to just ingress or egress, you will fix that issue.

You might want to double-check that and if these are "real" retransmissions, perhaps you can show me the traces as well as the config.

Hope it helps.