VLAN Span Direction Question

[ds5879.cisco]

We are monitoring vlan traffic on our core switch and sending it to an appliance. We have the following:

vlan 10 - workstation

vlan 20 - wan vlan (goes to another site)

Two questions:

Does the TX only option capture packets when a packet is traversing the vlan? So if traffic is generated from vlan 10 and sent to another site (having to traverse vlan 20) will I see duplicate packets (once when exiting vlan 10 and once when traversing vlan 20)?

Is there a recommendation on which way to use? TX or RX only?

Thanks in advance.

[Eugene Lau]

Hey

1. VLAN SPAN -> tx = traffic transmitted out of VLAN.

PC ---vlan10 -- L3 ---Router

You should see a single copy of a packet from PC to router

You should see a single copy of a packet from Router to PC

2. From an product architecture point of view, it may be different ports where the replication of the packet may occur, so in extreme or unique type cases, you may have to consider load on the hardware doing the replication.

Feature wise, rx or tx you will see the same traffic. if you did rx AND tx = duplicate packet captured.

HTH

Eugene