NAM captures imported into Wireshark

Akhtar Samo · ‎06-01-2010

Hi,

When we are importing capture files from SVC-NAM-2 into wireshark it shows a same packet multiple times, has any one observed this ? Whereas I can't see this behaviour in NAM itself.

Regards,

Akhtar

Calin C. · ‎06-02-2010

Hello

Yes, I have observed this, but not only in Wireshark, but also directly in the NAM module decoder.

But I think sometimes is normal (e.g. same packet as it's travelling through different VLANs). If you look at the lines, looks exactly the same, but if you do a deeper investigation, you'll find something different.

This was in my case.

You are looking at the exact sam file / portion of the file in the wireshark and NAM decoder and it looks different?

Calin

Please rate if useful!

Akhtar Samo · ‎06-10-2010

You are right Calin, duplicate packets have also been seen in the NAM decoder. This thing really makes troubleshooting difficult. I am really wondering whether this is a problem/ bug with NAM image(3.6(1b)) or a problem with RSPAN/SPAN. Calin which NAM image version you are using ?

Instead of using NAM when we plug in a PC for capturing using same SPAN I find no duplication in that, so i think this has something to do with NAM or SPAN when it spans the data to switch backplane and then to NAM data ports.

Would appreciate if anyone shares their observations.

Regards,

Akhtar

oysteins · ‎06-18-2010

I suppose that you are capture a VLAN?

We see exactly the same when we are captureing a VLAN, but if we cature a physical interface, there are no duplicates.

Regards

Øystein