0 Replies Latest reply: Jul 11, 2011 6:58 AM by Peter RSS

    Monitor session output on WS-C6509

    Peter

      Hi all,

       

      I have a problem on a WS-C6509 and don't know what is causing this behaviour. On the WS-C6509 there are 2 interfaces configured as an etherchannel in active mode. The etherchannel is connected to a windows server.

       

      The problem is that when i sniff the traffic(by copying the traffic to another port with the monitor session command) on the etherchannel that i can see al kinds of traffic from other hosts in the same vlan. It is not just broadcast traffic as you would expect but also unicast traffic like http or https sessions to other hosts in the vlan.

       

      Below the output of the show monitor detail command:

       

      SWx3#sho monitor detail

      Session 1

      ---------

      Type                   : Local Session

      Description            : -

      Source Ports           :

          RX Only            : None

          TX Only            : None

          Both               : Po34

      Source VLANs           :

          RX Only            : None

          TX Only            : None

          Both               : None

      Source RSPAN VLAN      : None

      Destination Ports      : Fa9/1

      Filter VLANs           : None

      Destination RSPAN VLAN : None

       

      The channel config below:

      SW13#sho runn int po34

      Building configuration...

       

      Current configuration : 206 bytes

      !

      interface Port-channel34

      description vh15

      no ip address

      switchport

      switchport trunk encapsulation dot1q

      switchport trunk native vlan 1001

      switchport trunk allowed vlan 1

      switchport mode trunk

      end

       

       

      Is there something wrong with monitoring etherchannels or is this switch kind of acting as a hub??!