Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

sniffer capturing unicast traffic on port where port mirroring disabled

We have a sniffer plugged into a 10/100 port on a 4006. Port mirroring is not enabled on this port, so we only expect to see broadcast traffic. In addition to BPDUs, ARPs, BOOTPs, etc... we are seeing unicast traffic (http, ldap) between two hosts plugged into other ports on the switch. It's not all the traffic between the two hosts, just a small subset. Why would this traffic show up at all?

  • Other Network Infrastructure Subjects
1 REPLY
Cisco Employee

Re: sniffer capturing unicast traffic on port where port mirrori

this is due to unicast flooding.

Look at the following url

http://www.cisco.com/warp/customer/473/143.html

235
Views
0
Helpful
1
Replies