Abnormal flow

Unanswered Question
Mar 13th, 2009
User Badges:

we have cisco 3560,the port 13 line to a server.the server ip is 10.96.94.36

we use command:

monitor session 1 source interface Gi0/13

monitor session 1 destination interface Gi0/20

we monitoring the port 20.But we found the port 20 has 10.96.94.70 and 10.96.94.81 flow between.the means is the port 13 has 10.96.94.70 and 10.96.94.81 flow between


so please help me!! thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Giuseppe Larosa Fri, 03/13/2009 - 03:15
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Chen,

verify going at the MAC address level


sh mac-address-table interface f0/13


then look for the MAC address you find in ARP table


sh ip arp | inc


this can tell you what is the effective IP address on device on port 0/13


also verify with sh monitor session if there are multiple source ports this could also explain what you see


Hope to help

Giuseppe


Actions

This Discussion