Sniffing problem with 802.1q on all frames in 2950 SPAN port
I have four Cat 2950XL switches connected. One is VTP server and the other are clients. They are interconnected via gigabit or etherchannel trunks.
When I activate SPAN monitoring on a port, I am seeing the whole 802.1q frame instead of the ethernet packet. This is causing great problems for my IDS system that is trying to listen to the traffic on the SPAN port.
Is there any way to disable this "feature" and just forward the ethernetframe to the SPAN port??
Re: Sniffing problem with 802.1q on all frames in 2950 SPAN port
Since there has been no response to your post, it appears to be either too complex or too rare an issue for other forum members to assist you. If you don't get a suitable response to your post, you may wish to review our resources at the online Technical Assistance Center (http://www.cisco.com/tac) or speak with a TAC engineer. You can open a TAC case online at http://www.cisco.com/tac/caseopen
If anyone else in the forum has some advice, please reply to this thread.
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...