monitor of flooded packets

cnicules · ‎02-11-2009

Hi,

one switch, 10 acces ports in vlan 10, on P1 a pc with sniffer, on P2 a pc with "source packets", i monitor in tx on the ports P3-P10, to the P20 in witch is connected another sniffer.

A packet entering the P2 with a unknown mac address is flooded on all the ports. I see it on the P1 sniffer, and i will see once on the SPAN sniffer of 8 times?

Thanks

Giuseppe Larosa · ‎02-11-2009

Hello Ciprian,

yes replications are possible SPAN for efficiency reasons doesn't track the frames.

Are you using as SPAN source vlan 10 or the 8 physical ports ?

Hope to help

Giuseppe

cnicules · ‎02-11-2009

the SPAN is port bassed on TX

Giuseppe Larosa · ‎02-11-2009

Hello Ciprian,

using Vlan 10 as source might be a way to see less copies of same unknown unicast frame but I'm not sure.

Hope to help

Giuseppe