Hi everyone. I'm trying to troubleshoot very slick problem, that's why I am following any suspicious behavior (for me).
We need to run traffic capturing and analyzing app, that has to be able to do deep packet inspection and able to replicate data from unencrypted protocols (ftp, http). It's third party app that runs on dedicated server and receives full copy of traffic via SPAN. Right now app can't identify files more than 10 MB, I get the same results trying to export object from HTTP via WireShark.
My test lab looks like this
(Web Server)---VLAN100---(ASR1001X)---VLAN1903---(CISCO 3759)---(Laptop)
I am running monitor session from Cisco 3759.
Session 1
---------
Type : Local Session
Source Ports :
Both : Gi1/0/23
Destination Ports : Gi1/0/11
Encapsulation : Native
Ingress : DisabledI am downloading test .txt file with size of ~ 96MB
But output bytes on cisco 1903 interface shows approximately 75 MB
52174 packets output, 79307491 bytes
ls -sh file_test.txt
96M file_test.txt
Is it normal behavior? In the end, I can download the whole file on the end machine, but tcpdump shows ~75 MB too.
#sh version
Cisco IOS XE Software, Version 16.05.01b
Cisco IOS Software [Everest], ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.5.1b, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2017 by Cisco Systems, Inc.
Compiled Tue 11-Apr-17 17:00 by mcpre
P.S regarding to general problem - I am trying to identify congestion, but can't find any drops on interfaces, participating in test lab.
