Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

Traffic I shouldn't see in a Sniffer trace????

No matter where I plug into, I see one-to-one traffic (host-to-host) not broadcasts. It seems like there is a switch or router broadcasting this traffic. Please point me in a better direction I can’t come up with any other ideas.

10 REPLIES
New Member

Re: Traffic I shouldn't see in a Sniffer trace????

Who are the hosts on the network that are implementing this one-to-one traffic?

New Member

Re: Traffic I shouldn't see in a Sniffer trace????

real world address -> workstation

The traffic is oneway. I don't see the workstation talking back

Re: Traffic I shouldn't see in a Sniffer trace????

Hi,

check MAC addresses in the frames. Aren't they multicasts or somehow strange? Maybe the hosts are using some special application to communicate (Symantec Ghost, PGP, e.g.)?

Regards,

Milan

New Member

Re: Traffic I shouldn't see in a Sniffer trace????

The MAC's are not multicast or broadcasts. How would an application produce this traffic?

New Member

Re: Traffic I shouldn't see in a Sniffer trace????

It could be unicast flooding. There are several possible reasons for this, so search Cisco.com for the term.

-A

Bronze

Re: Traffic I shouldn't see in a Sniffer trace????

What type of device are you plugging into?

New Member

Re: Traffic I shouldn't see in a Sniffer trace????

2950

New Member

Re: Traffic I shouldn't see in a Sniffer trace????

Which Sniffer software are you using ?

If you are using the Microsoft's Free Network Monitor.. it can only monitor one - one traffic..

just like a switch based network.. but if you sniff with the full version you will get the full prmoiscious capability..

New Member

Re: Traffic I shouldn't see in a Sniffer trace????

NAI - SNIFFER PRO

New Member

Re: Traffic I shouldn't see in a Sniffer trace????

I encountered the same Problem. I've got sniffer pro too, and with a c3550G-48 12.1(11)EA1, I had the same pbm. I moved to IOS 12.1(12c)EA1 And I have no longer unicast frames. It was not flooding because there was only a few unicast frames arriving on my port

114
Views
0
Helpful
10
Replies
CreatePlease to create content