Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
441
Views
0
Helpful
2
Replies

Question Re: ERSPAN

rtjensen4
Level 4
Level 4

‎04-19-2012 11:11 AM - edited ‎03-07-2019 06:14 AM

Hi All,

I'm using ERSPAN on my Nexus 5548 switches. Source: Interfaces on Nexus, destination: An Ubuntu box running Wireshark.

I'm able to capture packets with this method, but wireshark gives me TONS of expert errors saying: TCP Ack'd lost segment. This normal? My capture sources on the nexus is a vPC, so I should be getting traffic from both sides fo the VPC. Could it be lost packets at the NIC level? Anyway to tell?

Labels:
0 Helpful
2 Replies 2

rtjensen4
Level 4
Level 4

‎04-19-2012 11:12 AM

Well I may have answered my own question. I told wireshark to limit packet sizes to 100 bytes, no more Expert errors.

0 Helpful

rtjensen4
Level 4
Level 4

‎04-19-2012 11:42 AM

Ok, spoke too soon. Still have errors. How can i see if it's a NIC issue? My host running wireshark is Ubuntu 10.04 LTS 64-bit. I have set MTU on my ethernet interface up to 1700 and set MTU in ERSPAN sessio to 1518, max it will allow.

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card