Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Local SPAN session on a C2950

Hello,

I've configured a SPAN session like this:

monitor session 1 source interface Fa0/11 both

monitor session 1 destination interface Fa0/8

I use ethereal to capture the packets, the source interface contains a webserver.

The only packets I should see are the one's destinated or originated from the source interface and some broadcast/multicast packets (switching).

Why do I see traffic between other hosts ???

1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: Local SPAN session on a C2950

The other hosts I assume are from the same VLAN as the webserver. When a spanningtree change happens the switch will expire all the MAC entries in its table and begin to learn them again. This means the switch will flood all MACs that are now unknown to it, to all its ports in the affected VLAN until it learns their location. After relearning everything the switch will behave as a normal switch.

Type the command "show spanningtree detail | include last change" to confirm the suspicion. If the last change was minutes ago then you have identified a problem to troubleshoot with spanningtree instability.

Brian

4 REPLIES
New Member

Re: Local SPAN session on a C2950

The other hosts I assume are from the same VLAN as the webserver. When a spanningtree change happens the switch will expire all the MAC entries in its table and begin to learn them again. This means the switch will flood all MACs that are now unknown to it, to all its ports in the affected VLAN until it learns their location. After relearning everything the switch will behave as a normal switch.

Type the command "show spanningtree detail | include last change" to confirm the suspicion. If the last change was minutes ago then you have identified a problem to troubleshoot with spanningtree instability.

Brian

New Member

Re: Local SPAN session on a C2950

Yes, the other hosts are in the same vlan.

You mean that when a switch doesn't know the location of a mac-address it will forward all the traffic of this mac-address to all the ports on a switch?

command-output for "sh span...":

number of topology changes changes 15 last change occurred 23:17:01 ago

The capture was made yesterday around the time of the spanning-tree changes. That seems to be the problem !

Thanks for your input, I will take a look closer at spanning-tree.

Regards Marcel

New Member

Re: Local SPAN session on a C2950

To assist with the troubleshooting the command "show spanning-tree detail", on newer IOS and switches will display the port the switch received the last change from. Using this information you can track the problem back to it's source.

If a number of changes come in you can also use "debug spanning-tree events" to log the spanning tree changes to the switch log as they arrive for later investigation.

Brian

New Member

Re: Local SPAN session on a C2950

The destination interface (with the sniffer connected) was causing the toplogy change when I started the monitor session. I've started a new capture session after about 15 minutes and the packets captured were the ones I aspected, no other traffic flows.

Thanks !

125
Views
0
Helpful
4
Replies