RE: Observing duplicate frame captures in TCPDU MP

["Kraus, Jeffery" <Jeffery.Kraus () uscellular com>]

Catalyst Version Information is:
WS-C6506 Software, Version NmpSW: 7.2(2)
Copyright (c) 1995-2002 by Cisco Systems
NMP S/W compiled on Apr 25 2002, 12:55:52

System Bootstrap Version: 7.1(1)

Hardware Version: 3.0  Model: WS-C6506

As long as I am not running a SPAN port for the entire VLAN, I will not see
the duplicate frames. I have multiple devices on the same VLAN that will
process the same packet, because of this I am seeing the duplicate frames.
By selecting individual ports as part of the SPAN, instead of the whole
VLAN, I can prevent the packet duplication from occurring.


Jeffery Kraus
Data Services Engineer
773.216.3179 (cell)
224.653.3720 (office)
224.653.3766 (fax)


-----Original Message-----
From: Andrea Montefusco [mailto:andrea.montefusco () kyneste com]
Sent: Tuesday, December 30, 2003 3:19 AM
To: Kraus, Jeffery
Cc: 'George Bakos'; 'tcpdump-workers () tcpdump org'
Subject: Re: [tcpdump-workers] Observing duplicate frame captures in
TCPDU MP


Kraus, Jeffery wrote:
> In this scenario it is not 802.11. I have my Redhat 9 Box running TCPDUMP
> connected to a Cisco Catalyst 6509 using 10/100 CAT5e Ethernet on a port
> Spanning 2 VLANs. The Multiples frames are identical (every byte, MAC, IP,
> etc...) Although the timestamps are slightly different (off by less than a
> millisecond or so).
>
> It definitely seems to be an issue with the Cisco Span Port....I have
> connected a PC running Sniffer Pro and IRIS Sniffers, and are seeing the
> same thing. I will investigate this further with Cisco. Thank you all for
> your help.

Which version of CatOS are you using ?
I can see the same behaviour on my 650x with 5.4 version.

   *am*


---------------------------------------------------------
Andrea Montefusco                         Network Manager
Kyneste S.p.A.  Roma Via Mario Bianchini, 68
                 Milano Via della Posta, 3
tel: +3906874021 mob: +393356992791 fax: +390687402300
---------------------------------------------------------
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe