Wireshark capture on access port displays different vlan traffic

Hi Guys,
i have a nexus 4001i Blade Center Switch where i have a server connected in mode access to a particular vlan.
when i use wireshark on this port, i see different traffic conversations of different servers in different vlans which seems strange to me.
anybody have an idea why a server in mode access with wireshark is able to view different vlan traffic? I also see non multicast and non broadcast converations.
the port the server is connected to is not a monitor port but only in switch port mode access.
thanks in advance for you feedback

Hi,
So it looks like you're getting unicast traffic flooded to all ports. There are a couple of reasons I've come across that can cause this.
Asymmetric routing: See Unicast Flooding in Switched Campus Networks and/or Case Study #8: Asymmetric Routing and HSRP (Excessive Flooding of Unicast Traffic in Network with Routers That Run HSRP) for details of why it happens and how to prevent it.
Microsoft Network Load Balancing. As per the Microsoft Troubleshooting NLB:
In unicast mode (the default Forefront TMG cluster operation mode) NLB induces switch flooding, by design, relaying packets sent to the VIP addresses to all cluster hosts. Switch flooding is part of the NLB strategy for obtaining the best throughput for any specific load of client requests. However, if the NLB interfaces share the switch with other (non-cluster) computers, switch flooding can add to the other computers' network overhead by including them in the flooding and consequently have a detrimental effect on network and/or server performance.
Regards

Similar Messages

Traffic Between 2 Ports on Different VLANs on the Same Switch

Hi,
This question probably results from a flaw in my understanding of network layer 2 versus layer 3 and VLANs so any additional context in that regard would be very welcome
If I've got 2 systems on difference VLANs that are connected to ports on the same switch (e.g. 2950), with that switch being connected via an uplink to a router or layer 3 switch and i want to pass traffic between the 2 systems (e.g. copy a file from a folder shared on one system to another), will the traffic pass directly from one port on the 2950 to the other? Or will it need to go through the uplink? I guess it will need to go through the uplink initially as layer 3 needs to be involved for inter-VLAN routing but wondering if layer 2 MAC address will ultimately be learned, allowing traffic to pass directly between the systems, not over the uplink.
Thanks in advance,
cisco_reader.

If the hosts are on different Layer 2 Vlans and you want to pass data between them, that data needs to be 'Routed'.
In order to Route data from one Layer 2 Vlan to another, you need a device capable of Layer 3 Routing. That device can be a traditional Router or can be something called a Layer 3 switch.
A 2950 switch is Layer 2 only so has the ability to create many Layer 2 Vlans which is what you have done. In order to route traffic between those Vlans, you can either use a router or a L3 switch.
If you decided to use a router, look up something called 'Router on a Stick' which involves creating a Trunk link from the 2950 to the Router and then setting up Subinterfaces on the Routers port to act as the 'Default Gateway' for each of your Vlans.

Nexus1000v: Mgmt Port on different VLAN than host

I am setting up a pair of Nexus 1000v switches. As per the Cisco
documentation, I have the management port in the system-uplink
port-profile. However, currently, this management port is in the same
production VLAN as most of our servers. I would rather have the
management in an separate VLAN for security and reliability reasons.
Also, as I cannot assign a VLAN to both the system-uplink and the
data-uplink port-group, this means all of the server traffic will be
using the system-uplink port-group. This does not sound logical.
My question is:
1. Does the management port have to be in the same VLAN as the VM Host
server?
2. If is does, what are the implications of putting the management port
on the data-uplink port-group?
3. OR, if (1) is YES, then what do you think about putting the VM Hosts
(ESXI) on a separate VLAN than the virtual servers?
Note: I have been playing with svs domain mode l3. But as I cannot even
ping the gateway, I haven't had much success.

I would say you should seperate it.
One VLAN Management (mabye in ESX Managemt or Switchmanagement VLAN)
One VLAN for Packet & Contrl.
Others for Data (server, user traffic)
Seperate Management ist just for security reasons
The others should be seperated, because the are very important to let the nexus Work, If packets are lost, the hole nexus will get trouble to work.
Additional you should think about QoS if you don't use a seperate NIC for that traffic. I would suggest to use a bundle of NIC's for evetyhing and work with QoS to be High Available.
Thats my point of view after discussion in a nexus training and with a cisco technician.
regards,
Sebastain

Changing Link ports to Access ports in LMS 4.1

One of techs accidentally connected two access ports from different switches together. Since then, LMS is alerting them as being Link ports down. I tried to default the config and set them to access ports without any success. Any idea what I should do in LMS to recognize them as access ports? Thank you.

Rediscovering the device is sufficient.
Cheers,
Michel

Re:Can't able to access shared folders from different VLANs in SG300 series switches

Hi All,
I supplied 3 numbers of SG300 series switches for the sole reason to have inter-vlan routing. I created 4 VLANs in the switches and made one switch as Layer 3 switch and other 2 as Layer 2 switch. Inter-Vlan routing is working fine. I am able to ping PCs from different VLANs. But I am not to access shared folders. Customer has installed Window 2003 server installed and it is in VLAN 1. There are some folders created in this server and it is very important for users to have access to the folders.Also, I am not able to access shared folders in other VLANs. I have created a case with Cisco small business and I got a reply saying that the switches will not support shared folder feature, which I think is not real. I am getting a very time to implement this solution in the network. I have a Sonicwall firewall after Core switch which is connected to ISP.
ISP<----->Sonicwall FW<----->Core Switch<------>Layer 2 switch<------>Layer 2 switch
Kindly help me out to resolve this issue.
Regards,
Prashant K

Hi Prashant,
I think you're running into a Windows firewall issue. SMB file sharing, by default I believe, is only allowed on your local subnet. Please try disabling windows firewall on the computer hosting the shared folder, then see if you can access the shared file.
Best,
David
PS: It looks like this post got published twice. You can delete the other one using the task bar on the right.
Please remember to rate helpful resonses and identify correct answers.

2106 wlc different vlan accessibility

I have 1 2106 wlc 6 1131AG LAPs that are going to be placed in three vlans. All three vlans are created and configured on a 3550G switch.
I created two additional virtual interfaces on the WLC, tagged it with appropriate vlan number and connected the port with untagged vlan identifier to a dot1q enabled trunk port on the 3550 switch. That is,
man int - untagged, port 1
vlan2, tagged -2, port 2,3
vlan3, tagged -3, port 4,5
vlan4, tagged - 3, port 6
and port 1 is connected to a trunk port on the 3550G switch with dot1q.
I am not able to reach the created vlan interfaces on the WLC !?1?!
Kindly help?

jeff.velten, wouldn't that break the very use of the WLC? documents I referred from cisco recommend to connect the WLC to a trunked port. Like here: http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00805e7a24.shtml
So how are the vlan tags from the wlc not passed on to the trunk port? Is there something I missed, somewhere?

Multicast Does not work between different VLANS

Hi,
I have problems with multicast. On the same VLAN i can see the SAP announcement in VLC and play, but on different VLAN i can see SAP but i cant play it. The play turn to pause and the video doesn´t appear.
I have 2 Cisco 6500 switch CORE with GLBP configured but not working. In the second switch i have all interfaces in shutdown. The first core switch have L3 routing enable.
The Global configurations:
ip multicast-routing.
I have the transmitter PC on vlan 51 i transmit to 230.0.0.50 group an im trying to recive on vlan 80. The vlans configurations are:
Vlan 51
ip address x.x.31.254 255.255.255.0
ip pim sparse-dense-mode
Vlan 80
ip address x.x.80.1 255.255.255.0
ip pim sparse-dense-mode
I have 2 Cisco 2960 (L2 only) for the access.
The principal commands outputs are:
CORE1#show ip mroute | inc 230.0.0.50
(*, 230.0.0.50), 01:50:50/00:02:21, RP 0.0.0.0, flags: DC
CORE1#
CORE 1
interface Vlan1
ip address x.x.1.1 255.255.0.0
ip access-group 101 out
no ip unreachables
ip pim sparse-dense-mode
mls rp ip
interface Vlan51
ip address x.x.31.254 255.255.255.0
ip access-group 151 out
ip helper-address x.x.x.x
ip helper-address x.x.x.x
no ip unreachables
ip pim sparse-dense-mode
mls rp ip
interface Vlan80
ip address x.x.80.1 255.255.255.0
ip access-group 150 out
no ip unreachables
ip pim sparse-dense-mode
glbp 80 ip x.x.80.254
glbp 80 timers 5 18
glbp 80 timers redirect 600 7200
glbp 80 priority 254
glbp 80 preempt delay minimum 60
glbp 80 authentication text glbpkey
glbp 80 forwarder preempt delay minimum 60
CORE2
interface Vlan1
ip address x.x.1.4 255.255.0.0
ip access-group 101 out
no ip unreachables
ip pim sparse-dense-mode
mls rp ip
interface Vlan51
ip address x.x.31.2 255.255.255.0
ip access-group 151 out
ip helper-address x.x.x.x
ip helper-address x.x.x.x
no ip unreachables
ip pim sparse-dense-mode
shutdown
mls rp ip
glbp 51 ip x.x.31.254
glbp 51 timers 5 18
glbp 51 timers redirect 600 7200
glbp 51 preempt delay minimum 60
glbp 51 authentication text glbpkey
glbp 51 forwarder preempt delay minimum 60
interface Vlan80
ip address x.x.80.2 255.255.255.0
ip access-group 150 out
no ip unreachables
ip pim sparse-dense-mode
shutdown
mls rp ip
glbp 80 ip x.x.80.254
glbp 80 timers 5 18
glbp 80 timers redirect 600 7200
glbp 80 preempt delay minimum 60
glbp 80 authentication text glbpkey
glbp 80 forwarder preempt delay minimum 60
end
Someone can help?
Thanks,
Alfredo

Hi johnd...
Im using VLC 1.1.2 (i can not update because i have a DVDT2 card to capture the digital terrestrial television and it only work in this version). I have all the firewalls down.
This is the output for the show ip igmp snooping groups on the 2960.
80 230.0.0.50 igmp v2 Gi1/0/21, Gi1/0/24
Port G1/0/21 is where the receiver is conected and the 24port is the trunk.
Jon, i revert and this is the output. I put the ip pim rp-address the same of the lookpback that i create previously.
(*, 230.0.0.50), 00:37:46/00:02:19, RP 192.168.230.230, flags: SJC
Incoming interface: Null, RPF nbr 0.0.0.0
Outgoing interface list:
Vlan80, Forward/Dense, 00:09:52/00:00:00
The strange thing is that I have more than 40 vlans and it only fail in some vlans like 80.

AP On Different Vlan Than Controller

I have a 5508 controller at our headquarters and am installing some 3502 AP's at a remote branch. Unfortunatly, the remote branch has a different Vlan setup for some reason and the vlan that is used for the WLC (90) is designated for telephony at this branch. Can I put the AP's on a different VLAN (10) without having any issues? I will still use DHCP option 43 to point them back to the controller. Below are the configs for the WLC interfaces and what I am proposing for the AP interfaces:
WLC Config
interface GigabitEthernet1/1/38
description WLC01
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 90
switchport trunk allowed vlan 1,10,50,90,91,390,410-413,610-613,800,810,811
switchport mode trunk
channel-group 5 mode on
interface GigabitEthernet1/1/39
description WLC01
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 90
switchport trunk allowed vlan 1,10,50,90,91,390,410-413,610-613,800,810,811
switchport mode trunk
channel-group 5 mode on
interface Port-channel5
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 90
switchport trunk allowed vlan 1,10,50,90,91,390,410-413,610-613,800,810,811
switchport mode trunk
AP Interface Config
interface GigabitEthernet1/0/1
description *** Access Point AP001 ***
switchport access vlan 10
switchport mode access
spanning-tree portfast
Will this work?

Hi Pat,
When deciding to do LOCAL mode or CENTRAL SWITCH mode you need to consider a few items:
1) NAT -- If there is a NAT between both locations almost all customers would rather LOCAL mode. Reason being is the ability to access local resources without nat issues. Remember, central model has all traffic and IP addressing coming from the main office.
2) Internet / Main office connection - If the remote office is on a MPLS for exmaple. Using local switching is reartly used becuase if you lose the conenction with the main office you have bigger issues then having wireless access.
These are the 2 questions my customers always look at ...
I hope this helps...

Switch Port Trunk allowed Vlan

Hi Guys
Request your help on my query :
I have a distribution switch and access switch and port channel between them.
Dist switch is the VTP server
lets assum I have 25 vlan
when I do show vlan brief on the access switch I can see all 25 vlans listed now
no when I configure switch port trunk allowed vlan (ex : permitting 10 vlans )on the link connecting to access switch at Dist switch
Dist switch po1 -- connecting to - po Access switch
Dist switch #
int po1
switch port trunk alllowed vlan x,x,x,x,x,x,x,x,x,
After permitting 10 vlan through trunk allowed vlan and then when I do show vlan brief on the access switch , I should see only the 10 vlan whcih I have permiited right ?
Thanks in advance

Hi,
John is absolutely correct - even if you do not permit a VLAN on a trunk, it can still provide communication among local ports on a switch that are all assigned to the same VLAN.
I have a feeling that your original question was focused on a different aspect, though: You probably expected that if you exclude some VLANs from trunks, these VLANs will not be propagated via VTP to surrounding switches. Sadly, this is not the case. The switchport trunk allowed vlan command only affects data traffic in individual VLANs but it has no impact on the operation of VTP protocol. The VTP still advertises all VLANs, regardless of which VLANs are allowed on a trunk. To put it plainly, in a VTP domain, all server/client switches will know about all VLANs. THere is no legal possibility of having a single VTP domain consisting of server/client switch and yet have the switches differ in their VLAN database contents. It's as easy as that: one VTP domain = one big common VLAN database.
Best regards,
Peter

Uni port vs access port ---- nni port vs trunk

Dears,
Kindly advise difference between
1- uni port vs access port ?
2- nni port vs trunk port ?
Many Thanks
BR,
Sherif Ismail

Hi Sherif,
Well, i think u took it in different way, NNI and UNI are Network Port Types, for Isolating purpose, and Access and Trunks are operational attributes.
UNI Cannot Talk with UNI Port --Either its Access or Trunk.
NNI can Talk with NNI and UNI port --> its similar like Private VLANS.
NNI port will always be your Trunk or uplink port, it can also be your access port as well.
In UNI port you will connect your customers, and most probably it will be Access port.
In NNI port you will connect your uplink, and most probably it will be your Trunk port or could be your access port.
As per official Doc:
Q. What is UNI/NNI?
A. UNI/NNI is the classification of port types designed for the Metro Ethernet market. UNI, User Network Interface, is the interface that faces the subscriber, and NNI, Network Node Interface, is the interface that faces the service provider network. By labeling each port as UNI or NNI, the software can optimize each port for its role.

ASA 5505 switch from Mode: access Port to Trunk on the fly via CSM ?

Hi
Can I configure the Port at the ASA 5050 from Mode: access Port to trunk during the FW is running in a production area without console access ?
As I know at the 5505 ist should work
sincerley
Alfred

Are you using the same access port to access the ASA via CSM? If you are, then i would strongly recommend console access.
If you are using a different port to make the changes, then yes you can configure it. However, I would still recommend configuring it during non production hour, just in case there is an issue.

How to use different Vlans outside another gateway in sg-300 28?

dear all
how shall i use different vlans outside another gateway in sg-300 28?
Example:
vlan2 192.168.2.0/24 gateway 192.168.2.1 outside router gateway 192.168.2.254
vlan3 192.168.3.0/24 gateway 192.168.3.1 outside router gateway 192.168.3.254
should me doing in sg-300 28?
thanks.

Hi Amin,
Leave the switch in Layer 2 mode
Cable VLAN2 to the to the outside router gateway 192.168.2.254 interface
cable VLAN3 to the to the outside router gateway 192.168.3.254 interface
Excuse the rough diagram
Make the port going to the outside router gateway, untagged in the vlans they will be transporting. (I am assuming that the router gateway is not vlan aware.)
IP hosts will most likely get DHCP from the router gateway. The IP hosts will then automatically send IP traffic to the router gateway.
VLAN 1 in my switch, could then be the only interface within the switch that has a IP address associated with it, for management purposes.
I can see from you post, that English is not your first language, if you want to speak to someone, you can ask a question by going to;
www.cisco.com/go/sbsc
regards Dave

How to configure a port channel with VLAN trunking (and make it work..)

We're trying to configure a port channel group with trunked ports to connect a NetApp HA pair. We want to create two data LIFs and connect them to the switch stack. We are trying to create 2 data lifs, one for cifs and one for nfs that are on different vlans.
We want the same ports to be able to allow multiple vlans to communicate. (trunked)
These data lifs should be able to fail over to different nodes in the HA pair and still be able to communicate on the network.
What this means is that we have to connect 4 ports each for each node in the NetApp HA Pair to the switches and create a port channel of some type that allows for trunked vlans. When we configure the ports, the configuration is as follows (below):
We are only able to configure an IP on one of the vlans.
When we configure an IP from another vlan for the data lif, it does not respond to a ping.
Does anyone have any idea what I'm doing wrong on the Cisco switch?
interface GigabitEthernet4/0/12
description Netapp2-e0a
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet4/0/13
description Netapp2-e0c
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet6/0/12
description Netapp2-e0b
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet6/0/13
description Netapp2-e0d
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface Port-channel20
description Netapp2-NFS
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
spanning-tree portfast
spanning-tree bpduguard enable
end

Our problem was fixed by the storage people. They changed the server end to trunk, and the encapsulation / etherchannel.
I like all the suggestions, and they probably helped out with the configuration getting this to work.
Thanks!
interface Port-channel20
description Netapp2-NFS
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
interface GigabitEthernet4/0/12
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet4/0/13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet6/0/12
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet6/0/13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active

Can't disable my FTP Access ports!

Hi. I'm running MacOS X 10.3.9 on a Mac Powerbook with all of Apple's latest Security Updates installed. I did a virgin installation and no other software programs has been installed yet, and I need to find out if my current indicated FTP settings in the built-in Firewall panel is normal or whether maybe my system has been somehow hacked or attacked by an unknown virus.
In my computer's System Preferences/Sharing/Services panel, all options are currently off, and none of the items are checked. In the System Preferences/Sharing/Firewall panel, all options are also unchecked. But even though I've unchecked all items and they're supposed to be off, my FTP Access port is still showing the description "FTP Access (20-21, 1024-65535 from 20-21). First question - this lengthy description about my ports seem strange. Does everyone else show this same description in Panther, or is it just me?
But even more strange and bizarre is when I hover my mouse over the same FTP Access description, a balloon notation will pop up with the following information . . .
. . . "Ports 20 and 21 on your computer are open for FTP. If others connect to your computer from ports 20 and 21, then ports 1024 through 65535 are open. When you turn on FTP Access in the Services pane, you also allow the service access through the firewall on the indicated ports. To stop access through the firewall you must turn off this service using the Services pane." . . .
Personally, I don't want any ports open on my computer. Therefore this notation seems strange to me, especially considering that all my ports are supposed to be "off", therefore why is this notation still indicating that ports 20 and 21 are open. Even more strange is no matter what I do and no matter what settings I change, I can't alter the configuration of ports 20 and 21 and make them show as closed. I've tried everything, but ports 20 and 21 still remain open no matter what I do, at least according to this message. Question - Is what I'm seeing normal for everyone or are other users showing something different?
Below is an image of what I'm talking about :
http://homepage.mac.com/starshone/misc/PantherFTPAccess.jpg
Thanks in advance. Any help regarding this would be appreciated.
17" Mac Powerbook 1.5GHz Mac OS X (10.3.9)

If the problem is still there, try booting into the Safe Mode. Shut down the computer and then power it back up. Immediately after hearing the startup chime, hold down the shift key and continue to hold it until the gray Apple icon and a progress bar appear. The boot up is significantly slower than normal. This will reset some caches, forces a directory check, and disables all startup and login items, among other things. If the system operates normally, there may be 3rd party applications which are causing a problem. Try deleting/disabling the third party applications after a restart by using the application unistaller. For each disable/delete, you will need to restart if you don't do them all at once.
Safe Mode
Safe Mode - About
General information.
Isolating issues in Mac OS X
Troubleshooting Permission Issues
Step by Step to Fix Your Mac

How to create a Access Port in ASR901

Hi
I was tried to configured an ASR901 access port for my customer POC in ASR 901 but fail.
It does not support for switchport access VLAN commad .
I have suscessful setup a port-channel in ASR901 to the Alcatel switch and the LACP is up and in bundded state.
The question is how can I configure a access port mode (VLAN 100) in ASR901? The PC will need to
perform a PC Ping test from the ASR901 access port to the ALU Access port via the port-channel that I have configured.
I try to plug in my PC to the port Gi0/4 then run the Ping test from my PC to another PC that connected to Alcatel switch but fail as well.
PC (VLAN 100) Gi0/4 --- ASR901 --(LACP)--ALU --- PC (VLAN 100)
ASR901 configuration
interface Port-channel1
no negotiation auto
service instance 10 ethernet
encapsulation dot1q 100
bridge-domain 10
service instance 20 ethernet
encapsulation dot1q 200
bridge-domain 20
interface GigabitEthernet0/0
no negotiation auto
service instance 10 ethernet
encapsulation untagged
bridge-domain 10
interface GigabitEthernet0/1
negotiation auto
channel-group 1 mode active
interface GigabitEthernet0/2
negotiation auto
channel-group 1 mode active
interface GigabitEthernet0/3
speed 100
duplex full
no negotiation auto
interface GigabitEthernet0/4
no negotiation auto
cdp enable
service instance 10 ethernet
encapsulation dot1q 100
rewrite ingress tag pop 1 symmetric
bridge-domain 10
interface GigabitEthernet0/5
speed 100
duplex full
no negotiation auto
service instance 20 ethernet
encapsulation untagged
bridge-domain 10
interface GigabitEthernet0/6
speed 100
duplex full
no negotiation auto
service instance 10 ethernet
encapsulation untagged
bridge-domain 10
interface GigabitEthernet0/7
no negotiation auto
service instance 10 ethernet
encapsulation untagged
bridge-domain 10
Tq

Hi alexander,
But for function module MAster_idoc_distribute.
What are the parameters i need to pass for Logical systems and what i have to give in the Model distribute .
Can you explain me detail.How the sys knows have to maintain for sender and recevier sys.
As File port new to me.
Regards,
Madhavi.

Wireshark capture on access port displays different vlan traffic

Similar Messages

Maybe you are looking for