cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
372
Views
0
Helpful
1
Replies

odd SPAN problem

jourden.parks
Level 1
Level 1

I'm installing a Data Discovery appliance soon and during testing noticed it was only seeing one side of an MSN messenger conversation. I plugged in a laptop directly to the switch and ran tcpdump. Sure enough I saw SYN and ACK, but no SYN/ACK in between. Although strangely enough the whole conversation was in the MSN client.

I then checked to make sure that on the 3750 it was monitoring both directions. It was configured for both directions. Everything checks out correct but I still only see one side of the conversation. It occurred to me it may have something to do with VLANs but that looks good as well.

Any suggestions? Thanks.

1 Reply 1

royalblues
Level 10
Level 10

This can happen when the NIC card on the desktop used for spanning cannot run properly in promiscuous mode and does not capture all the packets

Have a look at this forum thread

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Unified%20Communications%20and%20Video&topic=IP%20Telephony&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cbf0117/8#selected_message

HTH

Narayan

Review Cisco Networking for a $25 gift card