Duplicate ACKs when Sniffing a Spanned VLAN

Unanswered Question
Mar 6th, 2009
User Badges:

I remember reading once that if you span a VLAN (instead of a port) you are likely to get duplicate ACKs and other problems when taking a sniffer trace (either WireShark or SnifferPro, doesn't matter). Cisco has an explanation of that problem - does anyone have the link?


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Gary-Brown Fri, 03/06/2009 - 13:10
User Badges:

Fast response for a Friday afternoon!!! Thanks - Anyone else?

Gary-Brown Mon, 03/09/2009 - 07:22
User Badges:

My colleague also got the following response from WireShark tech support:

"If you span a vlan, every packet will enter the switch and leave the switch on that vlan, hence the switch will mirror it twice. You should use "rx" or "tx" instead of "both" on the definition of the span-port when spanning a vlan.

You can remove the duplicate packets in the tracefile with "editcap -d " :-)

Hope this helps,




This Discussion