Destinations SPAN port on 9300 switch -is this a bug?

[jeppeqvist]

Hello, I have set up a stacked C9300 switch with 2 SPAN sessions. In the stack, switch 1 is configured with some copper ports defined as sources, which send traffic to the destination monitor port on the upper NIM module. I have connected a PC with Wireshark to this port as session 1. In switch 2 of the stack, I have also defined some source ports which send traffic to a different destination port on the lower NIM module. Here, I have connected another PC with Wireshark as session 2.

My question is: If, for example, I send traffic from switch 1 in VLAN 100 via an IXIA device to a port that is not part of session 2, why am I seeing the same traffic on both PCs? I should only be seeing it on the PC that is connected to session 1.

[DanielP211]

Hello,

Could you post the configuration to tshoot the issue?

BR

[jeppeqvist]

check below - 

[balaji.bandi]

its all depends on the config what source configured - how is your configuration looks like ?

check some config reference of cat 9K

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-9500-series-switches/218111-verify-span-and-erspan-on-catalyst-9000.html

[jeppeqvist]

check below...

[jeppeqvist]

monitor session 1 source interface gigabitEthernet 1/0/1 - 24 both

monitor session 1 destination interface TenGiga 1/1/2 encapsulation replicate

interface TenGigabitEthernet 1/1/2

description *** Monitor Session  1 IDS  ***

!

monitor session 2 source interface gigabitEthernet 2/0/1 - 24 both

monitor session 2 destination interface TenGiga 2/1/2 encapsulation replicate

interface TenGigabitEthernet 2/1/2

description *** Monitor Session  2 IDS  ***
!
!
Switch#show int status | include Monitoring

Port              Name                Status     Vlan       Duplex     Speed        Type

Te1/1/2  *** Monitor Session 1 IDS  ***   Monitoring     1            auto         auto      10/100/100

Te2/1/2  *** Monitor Session 2 IDS  ***   Monitoring     1            auto         auto      10/100/100          
!
!
!
switch# show monitor session all

Session 1

---------

Type                     : Local Session

Source Ports             :

    Both                 : Gi1/0/1-24

Destination Ports        : Te1/1/2

    Encapsulation        : Replicate

          Ingress        : Disabled

Session 2

---------

Type                     : Local Session

Source Ports             :

    Both                 : Gi2/0/1-24

Destination Ports        : Te2/1/2

    Encapsulation        : Replicate

          Ingress        : Disabled