C3560GC monitor session limitation

[vladakoci]

While performing troubleshooting for

https://supportforums.cisco.com/message/3874519   

I used a C3560GC as a switch simulating end device and generating the  traffic.

I used it also for data mirroring, set a monitor session in this way:

monitor session 1 source interface Gi0/1

monitor session 1 destination interface Gi0/2

What surprised me was that I did not see all the traffic that I expected to see on a PC with Wireshark connected to the port G0/2.

I used TAP ( physical mirroring ) then,  compared, and realized that the monitor session on C3560 for example does not show

- incoming BPDUs ( generated on the other switch being connected to the port g0/1 on C3560 )

- outgoing ( generated from within C3560 ) LLDP multicasts

- outgoing ( generated from within C3560 ) LOOP frames.

Generally speaking this is quite confusing as one would expect to see all the traffic.

Does anyone know is this expected or a bugy behaviour ? If expected, does any nice document exist that would show monitor session limitations per platform/IOS version?

Thank you,

Vlad

[Peter Paluch · Accepted solution]

Hello Vlad,

This behavior is correct. If you want to see the Layer2 management protocols running on a port, and not just the user traffic, the command about the destination port has to be written as follows:

monitor session 1 destination interface Gi0/2 encapsulation replicate

Check this link for more information:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_55_se/configuration/guide/swspan.html#wp1204187

Best regards,

Peter

[vladakoci]

Thanks Peter, works fine now.