cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1239
Views
0
Helpful
2
Replies

Retaining original Source MAC Address to SPAN Destination Port

varinacarey
Level 1
Level 1

I have a 3750 Cisco Switch on which I have configured a Local SPAN Session as follows:

 

Session 1
---------
Type              : Local Session
Source Ports      :
    Both          : Gi1/0/43-44
Destination Ports : Gi1/0/10
    Encapsulation : Native
          Ingress : Disabled

 

I have a laptop connected to port Gi1/0/10 with Wire Shark on it and the packets are not showing the correct MAC Address for the traffic. 

How do I get the SPAN traffic to keep the identical packets and MAC addresses right through to the SPAN Destination port?

 

Thanks

2 Replies 2

Hi,

 

SPAN does not change the mac of the packet it is mirroring. So what is the difference you are seeing or what do you expect to see in capture.

 

Thanks,

Madhu

Hi Madhu,

 

Thanks for reply.  The source ports of the SPAN port has 2 servers connected to them.  They are the phone servers that our IP phones register to. 

We have 2 core switches that have VLANs for different areas so the traffic is going: phone -- server -- switch -- core -- destination.

We are seeing the MAC address of the VLAN the servers are on, but, need to see the original MAC address of the actual phone that is sending the traffic.

Thanks,

Varina