PVST+ frames abound in sniffer trace on Core switch

Unanswered Question
Mar 5th, 2008
User Badges:

Hello. I work at a relatively small Client site where they have about 10 production VLAN's which are routed at a Core 4506 sw with a SUPII+ blade.

I do audits for protocol activity within each of these VLAN's by setting up the appropriate Port Monitor session on the switch and then capturing the traffic with Wireshark or Sniffer.

Irrespective of which VLAN I am in, I see alot of PVST+ traffic. I took a look at a couple of the frames, and they did not seem to be topology changes within ST.

Is it normal to see this much traffic being broadcast? The destination address is 01:00:0c:cc:cc:cd. thanks.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
lamav Wed, 03/05/2008 - 07:40
User Badges:
  • Blue, 1500 points or more


01:00:0c:cc:cc:cd is the ethernet multicast address for Cisco's shared spanning tree protocol.

BPDUs are sent out every 2 seconds.

So, just going by what you are giving us here, I would say that what you're describing is normal.



Kevin Melton Wed, 03/05/2008 - 12:06
User Badges:

That's what I thought.. Just wanted to make sure. Now i need to learn how to set Capture Filters in Wireshark to exclude those Frames.

Have a good one!


KMNR Network Resources, Inc.


This Discussion