Private VLAN PVLAN Captures

asked 2025-12-09 21:01:53 +0000

Cyclotol
1 ●1

updated 2025-12-09 21:03:20 +0000

Hi, I notice with our private vlans when gathering a wireshark capture using a port mirror for the primary vlan that I get duplicate packets or every line has a 2nd TCP DUP line. Is this expected for a PVLAN config? On the client device using wireshark to capture directly from its Ethernet interface I see some duplicate packets but also a lot of TCP PDU reassembled in.. remarks. Just wanted to compare to someone else in case I need to change something. Thank you!

answered 2025-12-09 21:23:17 +0000

SYN-bit

18600 ●9 ●372 ●255 https://SYN-b.it

If you created a SPAN session on a vlan with default options, it default to both directions. Which means every packet will be captured twice, as each packets enters and also leaves the vlan. When capturing a vlan, you can best use the rx keyword to only capture when packets enter the vlan (or tx, but I always had success with using rx)

edit flag offensive delete link

Comments

thanks, Syn-bit, that was my oversight using "both." I will give rx a try : )

Cyclotol ( 2025-12-09 21:27:39 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Private VLAN PVLAN Captures

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Private VLAN PVLAN Captures edit

1 Answer

Comments