Triple packet captured in RSPAN

[alanchia2000]

Hi,

I noticed that there was a triple capture on my monitoring console when using RSPAN and would like to find out if there is a way to filter that.

Scenario:

192.168.1.1 pings 192.168.2.1

Traffic was capture on all 3 switches when I monitor the source interfaces. Is there a way to prevent triple capture from happening?

Do take note that I am using routed interfaces and using trunk ports to transport RSPAN vlan traffic.

Attached contains the diagram of the scenario described.

[#2]

RSPAN supports source ports, source VLANs, and destination ports on different switches, which provides remote monitoring of multiple switches across your network.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html#wp1059482

[Giuseppe Larosa]

Hello Mun,

I had noticed a double capture in local SPAN when the source is a Vlan.

Here each ICMP packet appears at least twice:

packet sent from PC1

icmp echo request SA 192.168.2.1 DA 192.168.1.1

is received on monitored port on SW1

the packet travels and is sent out port on SW3

this should justify two copies.

From where the third copy comes it is difficult to say.

Hope to help

Giuseppe