this is the normal way switches do port mirroring. the 22 outgoing
packets are a copy of the incoming. it will only send 1 copy to the
monitoring port.
On 11/15/08, Mihovil Pupovac <mihovil.pupovac@xxxxxxxxx> wrote:
> Hi,
> I have a DLINK switch which has all 22 Rx and Tx ports mirrored to one port
> on which i connected wireshark. Switch receives an Ethernet brodcast ARP
> request which is then forwarded to all 22 switch ports. Why does wireshark
> show only one instance of that packet instead of 22 instances? Is there a
> mechanisam which prevents wireshark to show the same packet more than once?
> How do i override that mechanisam?
>
> Best regards,
> Mihovil
>
--
Regards, Martin
MartinVisser99@xxxxxxxxx
