I have a problem with local SPAN on a 3560. I can monitor a trunk port OK:
monitor session 1 source interface F0/1
monitor session 1 destination interface F0/8
Using Wireshark on F0/8, I can see the packets on F0/1 OK from both the phone (tagged VLAN) and the PC (untagged native). But of course what I cannot see is the CoS value ... which is what I am interested in. So I do:
monitor session 1 destination interface F0/8 encapsulation replicate
Now I don't see any packets at all on the Wireshark. The interface output counters on F0/8 are stll counting packets, but I see nothing on the monitor.
Has anyone else had this experience?
What NIC are you using? This sounds like a NIC driver issue although I would have expected traffic to be visible in Wireshark but the Tags being stripped off by the driver.
It you have an Intel NIC try here:
If its a Broadcom NIC try here:
I am not sure about other NIC's.