one-way traffic from source port - cisco etherchannel

asked 2020-05-28 02:57:23 +0000

anthony gravatar image

updated 2020-05-28 07:12:52 +0000

grahamb gravatar image

Hello;

We are setting up a port mirror on cisco n3k switch. We are trying to catch the flows from both directions The source interface for the port mirror is cisco port-channel (lacp)

The resulting packet capture is that we are only seeing one-way traffic

The port mirror indicates it is mirroring both TX and RX traffic but we are only seeing one-way traffic in wireshark capture

rmd-sw02# sh mon sess 1
   session 1
---------------
type              : local
state             : up
acl-name          : acl-name not specified
source intf       : 
    rx            : Po15          
    tx            : Po15          
    both          : Po15          
source VLANs      : 
    rx            : 
    tx            : 
    both          : 
filter VLANs      : filter not specified
source fwd drops  : 
destination ports : Eth1/31   
PFC On Interfaces :
edit retag flag offensive close merge delete

Comments

I noticed the same behaviour on our Nexus 5000 switches some years ago. Our Cisco partner told us that this is normal. But referring to the Cisco documentation it should be possible to monitor both directions of a port-channel with Cisco NX-OSRelease5.0(2)N2(1) or higher. I didn't spent much time to solve this issue, but I'm curious if somebody knows a solution.

JasMan gravatar imageJasMan ( 2020-05-29 13:09:06 +0000 )edit
add a comment