SPAN Session with Trunk Port-Channel and Encapsulation Replicate

[CHM1]

When I try to monitor a port-channel which is declared trunk and the encapsulation replicate option, i get only received frames and not transmitted ones;
If I omit the encapsulation replicate I get all the traffic (ingress and egress).
Anyone has an idea ?

Thanks

 

[Ru55ell]

Post the exact command syntax your using.

 

[CHM1]

The commands used :
1 - On my C3750 Stack (version 12.1(19)EA1c)

monitor session 1 source interface port-channel 1
monitor session 1 destination interface g4/0/23 encapsulation replicate

2 - and a Gigabit NIC on the PC which permits to pass the VLAN Tag to the sniffer (Ethereal) : Broadcom NetXtreme 57xx with the value "PreserveVlanInfoInRxPacket=1" in the windows registry.

What i get :

I only get received frames (with the Vlan tag if it is not the default vlan)
I I omit the encapsulation replicate keywords i get all the traffic ingress and egress.

 

[Ru55ell]

Guessing, would you need something similar to PreserveVlanInfoInTXPacket=1 (TX) also?

 

[CHM1]

I don't think so because :
- in the NIC'doc i did'nt find such a value;
- the destination port (monitoring port) never switches frames received (except if an IDS would be connected in which case the parameter "ingress" permits to forward ingress traffic; but it's not my case)