06-19-2015 02:53 AM
Hi Guys,
I just encountered this issue on the ASR9k when i did some mirroring on ports. Attached here is the captured tcpdump.
Config:
monitor-session WIRESHARK ethernet
destination interface GigabitEthernet0/2/0/9
interface GigabitEthernet0/2/0/9
description :MIRROR-TO-LAPTOP
interface GigabitEthernet0/2/0/16
description :TO-GW
ipv4 address x.x.x.25 255.255.255.252
monitor-session WIRESHARK ethernet direction tx-only
tia.
Jeff
06-19-2015 04:36 AM
hi Jeff,
it might be a mismatch between the interface type and monitor session specification (presuming all is ok on the laptop side). If you look into the dump of a single frame you should be able to see in which way was the data misinterpreted. Have you tried without "ethernet" keyword in the monitor-session interface command?
Aleksandar
06-19-2015 07:17 PM
Hi Alexander,
I cannot remove the ethernet keyword and looks like its the default type. Im also seeing FC Fiber Channel on the protocol when i use wireshark.
Jeff
06-20-2015 03:37 AM
Hi Jeff,
if it's not a security concern, could you share a hexdump of a single frame? I'd like to see how is it formatted.
/Aleksandar
06-21-2015 07:50 PM
06-22-2015 06:17 AM
ah yeah, this can happen if your span destination interface is not an l2transport...
jeff can you reconfigure g0/2/0/9 as:
int g 0/2/0/9 l2transport
<ifconfig>
and you should be all set.
xander
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide