Monitor session on vlan vs interface and retransmissions

[hoffa2000]

Hi all

I need help understanding one thing regarding the SPAN feature on a Catalyst 2960X. My case is I want to capture a specific subnet on a stack of 2960Xs running L2 switching only, the subnet is tied to a specific VLAN and the capturing device is an UbuntuPC with tcpdump.

What I don't understand is if I set the monitor source to the VLAN in question I get in excess of 30% retransmissions in Wireshark on the captured tcpdump. If I instead use the uplink trunk port as monitor source there are below 1% retransmissions.

Can anyone please shed some light on this?

/Fredrik

[pieterh]

please specify more details about your SPAN session configuration

my guess is it has to do with [rx | tx | both] option used (or NOT used -> default to BOTH)

[MHM Cisco World]

can you share your config ?

[hoffa2000]

I forgot about the config.

This is the config generating alot of retransmissions

monitor session 1 source vlan 403
monitor session 1 destination interface Gi4/0/37

While this one does not

monitor session 1 source interface Gi1/0/52
monitor session 1 source interface Gi4/0/52
monitor session 1 destination interface Gi4/0/37 encapsulation replicate