NAM captures imported into Wireshark

Unanswered Question
Jun 1st, 2010
User Badges:

Hi,


When we are importing capture files from SVC-NAM-2 into wireshark it shows a same packet multiple times, has any one observed this ? Whereas I can't see this behaviour in NAM itself.


Regards,


Akhtar

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Calin Chiorean Wed, 06/02/2010 - 04:56
User Badges:
  • Silver, 250 points or more

Hello


Yes, I have observed this, but not only in Wireshark, but also directly in the NAM module decoder.

But I think sometimes is normal (e.g. same packet as it's travelling through different VLANs). If you look at the lines, looks exactly the same, but if you do a deeper investigation, you'll find something different.

This was in my case.


You are looking at the exact sam file / portion of the file in the wireshark and NAM decoder and it looks different?


Calin


Please rate if useful!

Akhtar Samo Thu, 06/10/2010 - 03:04
User Badges:

You are right Calin, duplicate packets have also been seen in the NAM decoder. This thing really makes troubleshooting difficult. I am really wondering whether this is a problem/ bug with NAM image(3.6(1b)) or a problem with RSPAN/SPAN. Calin which NAM image version you are using ?


Instead of using NAM when we plug in a PC for capturing using same SPAN I find no duplication in that, so i think this has something to do with NAM or SPAN when it spans the data to switch backplane and then to NAM data ports.


Would appreciate if anyone shares their observations.



Regards,


Akhtar

oysteins Fri, 06/18/2010 - 01:32
User Badges:

I suppose that you are capture a VLAN?

We see exactly the same when we are captureing a VLAN, but if we cature a physical interface, there are no duplicates.


Regards

Øystein

Actions

This Discussion