PVST+ frames abound in sniffer trace on Core switch

Kevin Melton · ‎03-05-2008

Hello. I work at a relatively small Client site where they have about 10 production VLAN's which are routed at a Core 4506 sw with a SUPII+ blade.

I do audits for protocol activity within each of these VLAN's by setting up the appropriate Port Monitor session on the switch and then capturing the traffic with Wireshark or Sniffer.

Irrespective of which VLAN I am in, I see alot of PVST+ traffic. I took a look at a couple of the frames, and they did not seem to be topology changes within ST.

Is it normal to see this much traffic being broadcast? The destination address is 01:00:0c:cc:cc:cd. thanks.

lamav · ‎03-05-2008

K:

01:00:0c:cc:cc:cd is the ethernet multicast address for Cisco's shared spanning tree protocol.

BPDUs are sent out every 2 seconds.

So, just going by what you are giving us here, I would say that what you're describing is normal.

HTH

Victor

Kevin Melton · ‎03-05-2008

That's what I thought.. Just wanted to make sure. Now i need to learn how to set Capture Filters in Wireshark to exclude those Frames.

Have a good one!

Kevin

KMNR Network Resources, Inc.