Hi,
I'm running into a problem with monitor session.
I have configured 2 monitor session and monitor session 2 have only one source port and one destination port.
The problem is that the source port has little traffic but in the destination port I see more traffic (more than the sum of rx and tx). In the source interface I have only 254 packets/second (both rx and tx) and 941000bps. In the destination port I see 1016 packets/second and 9Mbps.
How can be this?
I have made some test, changing the source and destination ports, but the problem persists. Also I delete all de monitor session 2 and start the configuration again, but also continue the problem.
What you suggest me to do or test so I can solve de problem?
monitor session 2 source interface Gi2/26
monitor session 2 destination interface Gi1/47
6509#sh int Gi2/26
GigabitEthernet2/26 is up, line protocol is up (connected)
Hardware is C6k 1000Mb 802.3, address is 001f.9f3e.5019 (bia 001f.9e3e.0519)
Description: WEBSERVICE
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseT
input flow-control is off, output flow-control is on
Clock mode is auto
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters 00:05:01
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
30 second input rate 424000 bits/sec, 109 packets/sec
30 second output rate 517000 bits/sec, 145 packets/sec
35084 packets input, 17292139 bytes, 0 no buffer
Received 0 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
48616 packets output, 21320737 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
6509#sh int Gi1/47
GigabitEthernet1/47 is up, line protocol is down (monitoring)
Hardware is C6k 1000Mb 802.3, address is 001f.9e3f.505e (bia 001f.9e3e.055e)
Description: SPAN
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 2/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseT
input flow-control is off, output flow-control is off
Clock mode is auto
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:06:37, output hang never
Last clearing of "show interface" counters 00:05:30
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
30 second input rate 0 bits/sec, 0 packets/sec
30 second output rate 9093000 bits/sec, 1016 packets/sec
8 packets input, 576 bytes, 0 no buffer
Received 0 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
364895 packets output, 414782539 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
6509#
6509#sho monitor session 2
Session 2
---------
Type : Local Session
Source Ports :
Both : Gi2/26
Destination Ports : Gi1/47
Egress SPAN Replication State:
Operational mode : Centralized
Configured mode : Centralized (default)
6509#
Thanks in advance.
