Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Duplicate ACKs when Sniffing a Spanned VLAN

I remember reading once that if you span a VLAN (instead of a port) you are likely to get duplicate ACKs and other problems when taking a sniffer trace (either WireShark or SnifferPro, doesn't matter). Cisco has an explanation of that problem - does anyone have the link?

Thanks!!!

3 REPLIES

Re: Duplicate ACKs when Sniffing a Spanned VLAN

I don't have the cisco link but when I saw this issue I found the answer here :-

hxxp://www.groupstudy.com/archives/cisco/200706/msg00600.html

New Member

Re: Duplicate ACKs when Sniffing a Spanned VLAN

Fast response for a Friday afternoon!!! Thanks - Anyone else?

New Member

Re: Duplicate ACKs when Sniffing a Spanned VLAN

My colleague also got the following response from WireShark tech support:

"If you span a vlan, every packet will enter the switch and leave the switch on that vlan, hence the switch will mirror it twice. You should use "rx" or "tx" instead of "both" on the definition of the span-port when spanning a vlan.

You can remove the duplicate packets in the tracefile with "editcap -d " :-)

Hope this helps,

Cheers,

Sake

275
Views
0
Helpful
3
Replies