This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi ,

we have captured some wire shark traces from our equipment which is connected on L3 switch.

in the logs We are able to see the other devices communication/traffic (TCP messages) which is connected in same L3 switch.

Is this generic ...?

or gives some idea about traffic flow on L3 Switch with protocols.

asked 28 Feb '13, 20:31

Lokanadhareddy's gravatar image

Lokanadhareddy
1111
accept rate: 0%

edited 01 Mar '13, 02:33

grahamb's gravatar image

grahamb ♦
19.8k330206


Is this generic ?

as I understand your question:

  • You have a 'standard' switch (not a hub).
  • Your Wireshark machine is connected to a 'regular' switch port (access port).
  • You do see TCP traffic that is not related to your Wireshark machine

If that is all true, here are my guesses

  • You believe to have a switch, while you have a hub. In that case, you will see the whole network traffic.
  • The switch operates in fail-open mode and sends all packets to all ports. The reason for fail-open mode might be another system flooding the switch to be able to capture traffic. See http://wiki.wireshark.org/CaptureSetup/Ethernet. In that case, you will see the whole network traffic.
  • The switch port you are connected to is incidentally/accidentally a SAPN/mirror port. In that case you will see whatever traffic is mirrored to that port. Please check the switch configuration
  • You are seeing only those TCP packets that the switch needs to flood to all ports, as its MAC/CAM table timed out the entry for those MAC addresses. In that case, you should not see the whole TCP communication, but rather single packets.

Regards
Kurt

permanent link

answered 01 Mar '13, 09:18

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×115
×7

question asked: 28 Feb '13, 20:31

question was seen: 2,102 times

last updated: 01 Mar '13, 09:18

p​o​w​e​r​e​d by O​S​Q​A