Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

PVST+ frames abound in sniffer trace on Core switch

Hello. I work at a relatively small Client site where they have about 10 production VLAN's which are routed at a Core 4506 sw with a SUPII+ blade.

I do audits for protocol activity within each of these VLAN's by setting up the appropriate Port Monitor session on the switch and then capturing the traffic with Wireshark or Sniffer.

Irrespective of which VLAN I am in, I see alot of PVST+ traffic. I took a look at a couple of the frames, and they did not seem to be topology changes within ST.

Is it normal to see this much traffic being broadcast? The destination address is 01:00:0c:cc:cc:cd. thanks.

2 REPLIES
Blue

Re: PVST+ frames abound in sniffer trace on Core switch

K:

01:00:0c:cc:cc:cd is the ethernet multicast address for Cisco's shared spanning tree protocol.

BPDUs are sent out every 2 seconds.

So, just going by what you are giving us here, I would say that what you're describing is normal.

HTH

Victor

New Member

Re: PVST+ frames abound in sniffer trace on Core switch

That's what I thought.. Just wanted to make sure. Now i need to learn how to set Capture Filters in Wireshark to exclude those Frames.

Have a good one!

Kevin

KMNR Network Resources, Inc.

765
Views
0
Helpful
2
Replies