Ok guys, thanks so much for everyone's input. You may have noticed that i'm still very much learning this trade.
Here is a very rough picture of what I think must be happening.
- Left hand switch sends out ARP frames on vlan 1610
- An ARP frame is sent out of interface 1 (the interface being mirrored)
- interface 1 ARP frame is encapsulated in GRP and routed to the capturing server
- Capturing server receives GRP packet, decapsulates it, realises it's an ARP frame
- Capturing server doesn't understand how to respond to the ARP frame
- Capturing server sends the Type 3 Code 2 ICMP message to tell the source of the ARP that it doesn't understand the request
Am I anywhere near close?
