Wondered if anyone has seen this odd issue of duplicate packets being seen whilst having a monitoring sessions source as a vlan and destination is a remote vlan.
This is a voip environment and we are capturing the voip traffic to a recorder(s) however we are seeing duplicate packets for every single piece of traffic on the voice vlans in the edge stacks..
I am aware of the RX/TX of packets being seen twice and hence the duplicate packets, but in the configuration we have this should not occur.
The edge stack's monitor session's source is just the voice vlans configure don that stack. The destination is a remote vlan.
The core (two 4500's via VSS) monitor sessions source is the remote vlan with the destination being physical ports for the voice recorders.
The main VoIP hardware is located in a 3750-X stack which has no SPAN or RSPAN configured and uses different vlans to the edge users handsets.
The problem is even with a very basic handset to outside call, we are seeing duplicate packets. The monitor sessions on the edge stacks should only see the voice vlan traffic once since the other end of the traffic is the voice servers but they are not being spanned. Yes, I would expect to see duplicate packets for a handset to handset call within the same stack, but not in any other case.
My only thought is that the traffic is somehow being spanned twice, once on the port to the user and seen again on the uplink port towards the core even though it's all on the same vlan and all dot1q tagged?
Sample edge span configuration:
monitor session 1 source vlan 100 , 110 , 370 , 390
monitor session 1 destination remote vlan 600
Sample Core span configuration:
monitor session 1 destination interface Gi1/4/32
monitor session 1 source remote vlan 600
Any help would be appreciated.
