Data captured duing Span session

Unanswered Question
Mar 12th, 2008
User Badges:

I am looking at QoS issue on a cat 4500 (IOS). I have a span session set up to capture traffic (using Wireshark).

I configured the span session to only capure rx traffic.

Are the packets I captured un-changed by the switch before I see them in my capture? More specifically, am I seeing the original TOS marking on the packet or what the switch might have remarked it to.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Wed, 03/12/2008 - 15:08
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN


From 4500 configuration guide


Packets that are modified because of routing are copied without modification for Rx SPAN; that is, the original packet is copied. Packets that are modified because of quality of service (QoS)-for example, modified Differentiated Services Code Point (DSCP)-are copied with modification for Rx SPAN.


Full link:




This Discussion