Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

3750 Port Mirroring Gives Incorrect Times - Wireshark verified

Hi,

I was under the impression that port mirroring is supposed to assist in troubleshooting / diagnosis of traffic on one or more ports.

I have some weird results that simply don't make sense...

Standard PC to PC ping using hrping gives me a roundtrip time of ~0.100ms (or 100us).

Running wireshark on the 'source' PC, monitoring the same interface as the ping, gives me roundtrips of ~95us. A slight difference, but nothing to write home about (perhaps due the way that wireshark or hrping measures times).

This is where it gets strange...

Using a second nic on the 'source' PC, and port mirroring the source interface on the 3750 switch to this secondary nic, shows a round trip time of ~50us - A big difference.

Maybe the secondary nic is reporting this incorrectly? I then used a separate PC to monitor the pings on the switch, and this gives me the same ~50us result.

Has anyone got any ideas why I would get different results (even better results) from the port mirror than the original ports / interface?

2 REPLIES
Silver

Re: 3750 Port Mirroring Gives Incorrect Times - Wireshark verifi

The Switched Port Analyzer (SPAN) feature, which is sometimes called port mirroring or port monitoring, selects network traffic for analysis by a network analyzer.

This link may help.

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#src

New Member

Re: 3750 Port Mirroring Gives Incorrect Times - Wireshark verifi

Thanks.

517
Views
0
Helpful
2
Replies