Duplicate ACKs when Sniffing a Spanned VLAN

Gary-Brown · ‎03-06-2009

I remember reading once that if you span a VLAN (instead of a port) you are likely to get duplicate ACKs and other problems when taking a sniffer trace (either WireShark or SnifferPro, doesn't matter). Cisco has an explanation of that problem - does anyone have the link?

Thanks!!!

adamclarkuk_2 · ‎03-06-2009

I don't have the cisco link but when I saw this issue I found the answer here :-

hxxp://www.groupstudy.com/archives/cisco/200706/msg00600.html

Gary-Brown · ‎03-06-2009

Fast response for a Friday afternoon!!! Thanks - Anyone else?

Gary-Brown · ‎03-09-2009

My colleague also got the following response from WireShark tech support:

"If you span a vlan, every packet will enter the switch and leave the switch on that vlan, hence the switch will mirror it twice. You should use "rx" or "tx" instead of "both" on the definition of the span-port when spanning a vlan.

You can remove the duplicate packets in the tracefile with "editcap -d " :-)

Hope this helps,

Cheers,

Sake