Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a ZyXel ES-2024 PWD switch. I would like a computer plugged into port 26 to see all traffic that passes through port 2, both inbound and outbound.

I have configured port mirroring for the appropriate port for both ingress and egress traffic as per the manual. However, when viewing the packets in Wireshark, I appear to see all packets TWICE.

I suspect this is related to traffic flowing around the switch and research on the internet shows some similar problems occuring with SPAN ports, but I am unable to find a definitive answer.

I have tried filtering to ingress or egress traffic; I still see double the respective packets.

Has anyone experienced similar trouble with this or another switch who could possibly point me in the right direction. Many thanks in advance.

share|improve this question
    
Can ypu post a screenshot of the Wireshark capture showing the duplicate traffic? Also, have you tried a different capture tool to see if the results are the same? I use this one quite often - colasoft.com/capsa-free –  joeqwerty May 1 at 17:58
    
Thanks the response - I am out now but will post a wireshark trace when back in. I can confirm though that other tracers show the same result. –  user1014679 May 1 at 18:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.