Network Engineering Stack Exchange is a question and answer site for network engineers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Something on my Ethernet LAN is occasionally sending out spurious duplicate packets and I need to track it down. The culprit is likely a switch or other bridge (such as a Wi-Fi AP) and not an endpoint, because the packets that get duplicated are not always from the same source MAC address.

I'm thinking of getting a manageable switch that supports port mirroring, and using it with a sniffer to sniff traffic going into and out of a port, but I need to know which direction each captured packet was sent, so I can tell which direction the original and the duplicate came from. If I can find a place on my network where the original and duplicate came from different directions, I'll know that the culprit must be on the side where the duplicate came from.

My problem is, the port-mirroring switches I've worked with in the past have only allowed me to mirror "both directions" (both transmit and receive) from a given port, to the mirror port.

Can anyone suggest a solution that would allow me to mirror just one direction? I'm thinking of hooking up two sniffers, one for the "Tx" direction, and one for the "Rx" direction, so I can tell which way the packets were going. I don't mind buying a new manageable switch or tap to achieve this.

I'm open to any other ideas for tracking down the source of spurious packet duplication, but beware that my current switches on this network aren't terribly manageable, so solutions that assume manageable switches (like "enable such-and-such packet tracing", or "pull stats from all your switches via SNMP and crunch the data in <app>") aren't likely to be practical in my situation.

share|improve this question
up vote 10 down vote accepted

On Cisco switches, you can configure whether you mirror rx, tx or both;

For example:

monitor session 1 source interface gi0/1 rx

for receive

monitor session 1 source interface gi0/1 tx

for transmit

monitor session 1 source interface gi0/1 

If you don't specify, you mirror both tx and rx

share|improve this answer

There's also the option of {building,buying} a hardware network tap - here are some options for building half-duplex taps:

share|improve this answer
Those inexpensive ones only work for 10/100 which use separate pairs for Tx and Rx. GigE uses all 4 pairs bi-directionally, so it takes a more expensive tap design. But this could work if I decide I don't mind dropping the links I'm testing to 100Mbit while they're being tested. – Spiff May 2 '14 at 7:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.