This is our old Q&A Site. Please post any new questions and answers at

First of all, sorry about bit clunky title. Tried to make it as informational as possible.

I have a following topology in GNS3:

"SW" is a Cisco 3640 router with NM-16ESW 16-port 10/100 EtherSwitch Network Module. Port Fa0/0 of "SW" is an access port in VLAN 5. I have mirrored both Rx and Tx traffic of port Fa0/0 to port Fa0/10:

SW#sh run | i monit
monitor session 1 source interface Fa0/0
monitor session 1 destination interface Fa0/10
SW#sh monitor session 1
Session 1
Source Ports:
    RX Only:       None
    TX Only:       None
    Both:          Fa0/0
Source VLANs:
    RX Only:       None
    TX Only:       None
    Both:          None
Destination Ports: Fa0/10
Filter VLANs:      None


There is a Debian VM running Wireshark 1.2.11 listening on eth2 interface which is bridged with tap0 interface in Virtualbox configuration. VM eth2 interface is connected to port Fa0/10. Now if I telnet to "router" from "R1":


Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/16 ms
Trying ... Open


[Connection to closed by foreign host]

..I expect to see ARP, ICMP and IP traffic in Wireshark output. However, I capture only SPT and CDP traffic:

Any ideas what might cause this?

asked 18 Feb '13, 15:13

mrtn's gravatar image

accept rate: 0%

within GNS3 you can capture traffic directly on the network connections (If Wireshark is installed on your GNS3 'host'). To figure out if the SPAN port works, capture traffic on Fa0/10 in GNS3. Select the connection, then right click and choose "capture". See here:

  • If you see the mirrored traffic on Fa0/10, you might have a problem with Virtualbox or the NIO connection to the Switch.

  • If you don't see the mirrored traffic on Fa0/10, there might be a problem with the SPAN feature of your switch module (firmware related) or with GNS3 itself !?!


permanent link

answered 19 Feb '13, 08:28

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 19 Feb '13, 08:31

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 18 Feb '13, 15:13

question was seen: 5,892 times

last updated: 19 Feb '13, 08:31

p​o​w​e​r​e​d by O​S​Q​A