Abnormal flow

[chenkonal]

we have cisco 3560,the port 13 line to a server.the server ip is 10.96.94.36

we use command:

monitor session 1 source interface Gi0/13

monitor session 1 destination interface Gi0/20

we monitoring the port 20.But we found the port 20 has 10.96.94.70 and 10.96.94.81 flow between.the means is the port 13 has 10.96.94.70 and 10.96.94.81 flow between

so please help me!! thanks

[Giuseppe Larosa]

Hello Chen,

verify going at the MAC address level

sh mac-address-table interface f0/13

then look for the MAC address you find in ARP table

sh ip arp | inc

this can tell you what is the effective IP address on device on port 0/13

also verify with sh monitor session if there are multiple source ports this could also explain what you see

Hope to help

Giuseppe