Span Switch

[Mhon Baul]

Hi All,

I would like to inquire if ever i put a pc w/ a wireshark member of a vlan for ex. vlan 200,then i run the wireshark is it normal that i see the traffic of other pc even they are on another switch but still member of vlan 200? Appreciate all of your response!

cheers!

reymon

[Beat.Traber]

Reymon,

it is normal for a span session that you see broadcasts, multicasts, unknown unicasts of the same vlan, but you should not see other traffic

Beat

[Mhon Baul]

hi beat,

thanks for your response. i havent configured span on the switch, i just run the wireshark and seen the traffic of the two host that were in the same vlan but different switch.

[ravikumar.basavegowda]

Span is used to see traffic on that switch along with other broadcasts and unicast, however if you want to see the traffic on the same vlan, but different swtiches, you need to use Rspan.

[Mhon Baul]

yes you are right, but i want to clarify if it is possible to see traffic of two host on the same vlan but different switch even i did'nt configure span on the switch. i just run the wireshark on the pc.

cheers!

reymon