I am monitoring one of my VLANs. I use a reflector port to an RSPAN VLAN. The switch is a 3550. When I analyze the resutlts in my sniffer, I notice I am getting both RX/TX for the port in question.
The port has an IP phone connected to it. I dial from a PSTN line in to that phone, and the sniffer shows the 2 way conversation, when I expected to only see the PSTN side (RX) of the conversation. But as I mentioned, I see TX and RX. Why is that? Quite frankly, I prefer RX/TX, but this makes no sense.
Sample of my config:
My sniffer is connected to port fa0/47 on the dest switch. Nothing is connected to Fa0/24 on the monitored switch
Source switch:
IP Phone connected to Fa0/15
interface FastEthernet0/15
switchport access vlan 2
switchport mode access
switchport voice vlan 2
no ip address
duplex full
speed 100
spanning-tree portfast
monitor session 1 source vlan 2 rx
monitor session 1 destination remote vlan 500 reflector-port Fa0/24
NOTHING IS CONNECTED TO Fa0/24
interface FastEthernet0/24
switchport mode access
no ip address
spanning-tree portfast
Destination switch:
monitor session 1 destination interface Fa0/47
monitor session 1 source remote vlan 500
interface FastEthernet0/47
switchport access vlan 500
switchport mode access
no ip address
spanning-tree portfast
