Hi,

I was under the impression that port mirroring is supposed to assist in troubleshooting / diagnosis of traffic on one or more ports.

I have some weird results that simply don't make sense...

Standard PC to PC ping using hrping gives me a roundtrip time of ~0.100ms (or 100us).

Running wireshark on the 'source' PC, monitoring the same interface as the ping, gives me roundtrips of ~95us. A slight difference, but nothing to write home about (perhaps due the way that wireshark or hrping measures times).

This is where it gets strange...

Using a second nic on the 'source' PC, and port mirroring the source interface on the 3750 switch to this secondary nic, shows a round trip time of ~50us - A big difference.

Maybe the secondary nic is reporting this incorrectly? I then used a separate PC to monitor the pings on the switch, and this gives me the same ~50us result.

Has anyone got any ideas why I would get different results (even better results) from the port mirror than the original ports / interface?