Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Two Copies of Each Packet seen using NAM

When capturing traffic for ONE vlan using the NAM I can see two copies of the same packet for every packet sent.

Can anyone explain this.

Thanks in advance.

2 REPLIES
Cisco Employee

Re: Two Copies of Each Packet seen using NAM

Can you provide more details? Such as IOS versions, details on the SPAN session, modules installed in the switch etc?

One bug I had to deal with recently is

http://www.cisco.com/cgi-bin/bugtool/onebug.pl?bugid=CSCef56273

Which is duplicated by

http://www.cisco.com/cgi-bin/bugtool/onebug.pl?bugid=CSCee78323

Community Member

Re: Two Copies of Each Packet seen using NAM

Hi and thanks for your reply.

We are using the following software versions on the various modules installed in the 6509s:

Model Sw

------------------ -----------

WS-SVC-NAM-1 3.4(1a)

WS-SVC-IDSM-2 4.1(5)S208

WS-SVC-FWM-1 2.3(2)4

WS-SUP720-3B 12.2(18)SXD4

WS-X6704-10GE 12.2(18)SXD4

WS-X6724-SFP 12.2(18)SXD4

WS-X6748-GE-TX 12.2(18)SXD4

The span session which we ususally configure usning the NAM is as follows:

monitor session 2 source vlan 206

monitor session 2 destination analysis-module 1 data-port 1

A "Show monitor" request gives the following:

Session 2

---------

Type : Local Session

Source VLANs :

Both : 206

Destination Ports : analysis-module 1 data-port 1

I have had a look at the bugs that you listed. I amust admit that I dont really understand the description in the first bug report. The second bug report references a line card which we do not have installed so I guess that this one would not apply.

When we are capturing packets with the NAM as I originally mentioned it appears that we are seeing two copies of packests that are being received from a client within a particular VLAN but only one copy of packets that are transmitted back to the same client on the same VLAN.

In addition, if we perform a capture (using Etherreal) on the client in question, we only see one packet being transmitted by the client but we can see this same packet twice on the captures taken from the NAM.

118
Views
0
Helpful
2
Replies
CreatePlease to create content