Triple packet captured in RSPAN

Unanswered Question
Apr 23rd, 2009


I noticed that there was a triple capture on my monitoring console when using RSPAN and would like to find out if there is a way to filter that.

Scenario: pings

Traffic was capture on all 3 switches when I monitor the source interfaces. Is there a way to prevent triple capture from happening?

Do take note that I am using routed interfaces and using trunk ports to transport RSPAN vlan traffic.

Attached contains the diagram of the scenario described.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Giuseppe Larosa Thu, 04/30/2009 - 21:21

Hello Mun,

I had noticed a double capture in local SPAN when the source is a Vlan.

Here each ICMP packet appears at least twice:

packet sent from PC1

icmp echo request SA DA

is received on monitored port on SW1

the packet travels and is sent out port on SW3

this should justify two copies.

From where the third copy comes it is difficult to say.

Hope to help



This Discussion