I have set up a SPAN session on a switch within a campus network:
Type : Local Session
Source Ports :
Both : Gi0/18
Destination Ports : Gi0/23
Encapsulation : DOT1Q
Ingress : Disabled
Por Gi0/18 (source) is a trunk port with native VLAN 20. The connected router on this port also uses VLAN 20 as a native VLAN.
Port Gi0/23 (destination) is a trunk port with native VLAN 2. It is connected to a virtual linux machine with Wireshark installed.
I am particularly interested in VLAN 20 on port Go0/18, so initially I set up Wireshark to capture only untagged packets and captured 87,000 packets in one minute.
I later saw that I was getting some traffic tagged with VLAN 20 - I was surprised as I expected the encapsulation on the source port to mean that VLAN 20 would not be tagged. I set up a capture session to only capture packets tagged on VLAN 20 and captured 65,000 packets in one minute. In other words, the flows seem to be fairly evenly balanced between tagged and untagged packets on VLAN 20.
Should I be concerned about this, or is it normal behaviour (based on direction, perhaps)?