This is our old Q&A Site. Please post any new questions and answers at

When sniffing on a cisco span, it looks like the Rx and TX traffic are buffered. If I look at one tcp session I get a range off Tx packets and after that a whole rage of Rx tcp ack packages. (more then 20 in a row). Is this normal span behavoir?

asked 07 Oct '15, 04:57

stobbe99's gravatar image

accept rate: 0%

I think your question is: "By creating a SPAN port, does traffic to the SPAN port become affect?"

The answer is: YES! Even Cisco in their own white paper states:

"Cisco warns that the switch treats SPAN data with a lower priority than regular port-to-port data. In other words, if any resource under load must choose between passing normal traffic and SPAN data, the SPAN loses and the mirrored frames are arbitrarily discarded. This rule applies to preserving network traffic in any situation. For instance, when transporting remote SPAN traffic through an Inter Switch Link (ISL), which shares the ISL bandwidth with regular network traffic, the network traffic takes priority. If there is not enough capacity for the remote SPAN traffic, the switch drops it."

Link to white paper:

So depending on the load of your switch, your traffic might be affected.

Also, here is another great article:

In the article, it states: "Spanning or mirroring changes the timing of the frame interaction (what you see is not what you get)"

permanent link

answered 07 Oct '15, 11:59

Amato_C's gravatar image

accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 07 Oct '15, 04:57

question was seen: 1,794 times

last updated: 07 Oct '15, 11:59

p​o​w​e​r​e​d by O​S​Q​A