ASR 9010 Mirror Issue

[jeffersoncbriones]

Hi Guys,

I just encountered this issue on the ASR9k when i did some mirroring on ports. Attached here is the captured tcpdump. 

Config:

monitor-session WIRESHARK ethernet
 destination interface GigabitEthernet0/2/0/9

interface GigabitEthernet0/2/0/9
 description :MIRROR-TO-LAPTOP

interface GigabitEthernet0/2/0/16
 description :TO-GW
 ipv4 address x.x.x.25 255.255.255.252
 monitor-session WIRESHARK ethernet direction tx-only

tia.

Jeff

[Aleksandar Vidakovic]

hi Jeff,

it might be a mismatch between the interface type and monitor session specification (presuming all is ok on the laptop side). If you look into the dump of a single frame you should be able to see in which way was the data misinterpreted. Have you tried without "ethernet" keyword in the monitor-session interface command?

Aleksandar

[jeffersoncbriones]

Hi Alexander,

I cannot remove the ethernet keyword and looks like its the default type. Im also seeing FC Fiber Channel on the protocol when i use wireshark.

Jeff

[Aleksandar Vidakovic]

Hi Jeff,

if it's not a security concern, could you share a hexdump of a single frame? I'd like to see how is it formatted.

/Aleksandar

[jeffersoncbriones]

Hi Aleksander,

Pls find attached. 

[xthuijs]

ah yeah, this can happen if your span destination interface is not an l2transport...

jeff can you reconfigure g0/2/0/9 as:

int g 0/2/0/9 l2transport

<ifconfig>

and you should be all set.

xander