Local SPAN session on a C2950

[marcelscheller]

Hello,

I've configured a SPAN session like this:

monitor session 1 source interface Fa0/11 both

monitor session 1 destination interface Fa0/8

I use ethereal to capture the packets, the source interface contains a webserver.

The only packets I should see are the one's destinated or originated from the source interface and some broadcast/multicast packets (switching).

Why do I see traffic between other hosts ???

[bbaillie · Accepted solution]

The other hosts I assume are from the same VLAN as the webserver. When a spanningtree change happens the switch will expire all the MAC entries in its table and begin to learn them again. This means the switch will flood all MACs that are now unknown to it, to all its ports in the affected VLAN until it learns their location. After relearning everything the switch will behave as a normal switch.

Type the command "show spanningtree detail | include last change" to confirm the suspicion. If the last change was minutes ago then you have identified a problem to troubleshoot with spanningtree instability.

Brian

[marcelscheller]

Yes, the other hosts are in the same vlan.

You mean that when a switch doesn't know the location of a mac-address it will forward all the traffic of this mac-address to all the ports on a switch?

command-output for "sh span...":

number of topology changes changes 15 last change occurred 23:17:01 ago

The capture was made yesterday around the time of the spanning-tree changes. That seems to be the problem !

Thanks for your input, I will take a look closer at spanning-tree.

Regards Marcel

[bbaillie]

To assist with the troubleshooting the command "show spanning-tree detail", on newer IOS and switches will display the port the switch received the last change from. Using this information you can track the problem back to it's source.

If a number of changes come in you can also use "debug spanning-tree events" to log the spanning tree changes to the switch log as they arrive for later investigation.

Brian

[marcelscheller]

The destination interface (with the sniffer connected) was causing the toplogy change when I started the monitor session. I've started a new capture session after about 15 minutes and the packets captured were the ones I aspected, no other traffic flows.

Thanks !