I the scenario below;

I can sniff the traffic between Win7 and UbuntuSrvr on Line A

but this is cannot be done on Line B

Note: ports are on trunk mode.

Why this is happening??

enter image description here

  • 2
    Why do think you should see that traffic on link B? It never crosses that link.
    – Zac67
    Oct 15, 2021 at 19:36
  • 1
    Switches learn where hosts are connected and only send the traffic for a host to the interface where a host is connected.
    – Ron Maupin
    Oct 15, 2021 at 19:40
  • You mean Switch IOU1 knows the MAC address of UbuntuSrvr?? So, what about Switch IOU2??
    – Mehran
    Oct 15, 2021 at 20:00

1 Answer 1


Assuming Win7 and ubuntuSrvr1 are using IPv4 in the network layer: Win7 initially ARPs Srvr1's IP address, making all switches in the L2 segment/broadcast domain/VLAN aware of its MAC address and port. When Srvr1 replies to that ARP request, all switches between them learn Srvr1's MAC address and port as well.

Any following unicast traffic then gets forwarded on the direct path between those hosts. Link B is not on that path, so you can't tap into their traffic there.

Whether or not VLANs and trunks are used doesn't matter as long as the two hosts are connected to the same VLAN.

If they weren't on the same VLAN but got routed on R1, traffic would cross neither A nor B.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.