Duplicate ACKs when Sniffing a Spanned VLAN

Unanswered Question
Mar 6th, 2009

I remember reading once that if you span a VLAN (instead of a port) you are likely to get duplicate ACKs and other problems when taking a sniffer trace (either WireShark or SnifferPro, doesn't matter). Cisco has an explanation of that problem - does anyone have the link?

Thanks!!!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Gary-Brown Mon, 03/09/2009 - 07:22

My colleague also got the following response from WireShark tech support:

"If you span a vlan, every packet will enter the switch and leave the switch on that vlan, hence the switch will mirror it twice. You should use "rx" or "tx" instead of "both" on the definition of the span-port when spanning a vlan.

You can remove the duplicate packets in the tracefile with "editcap -d " :-)

Hope this helps,

Cheers,

Sake

Actions

This Discussion