Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a ZyXel ES-2024 PWD switch. I would like a computer plugged into port 26 to see all traffic that passes through port 2, both inbound and outbound.

I have configured port mirroring for the appropriate port for both ingress and egress traffic as per the manual. However, when viewing the packets in Wireshark, I appear to see all packets TWICE.

I suspect this is related to traffic flowing around the switch and research on the internet shows some similar problems occuring with SPAN ports, but I am unable to find a definitive answer.

I have tried filtering to ingress or egress traffic; I still see double the respective packets.

Has anyone experienced similar trouble with this or another switch who could possibly point me in the right direction. Many thanks in advance.

share|improve this question
Can ypu post a screenshot of the Wireshark capture showing the duplicate traffic? Also, have you tried a different capture tool to see if the results are the same? I use this one quite often - – joeqwerty May 1 '14 at 17:58
Thanks the response - I am out now but will post a wireshark trace when back in. I can confirm though that other tracers show the same result. – Raiden616 May 1 '14 at 18:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.