A likely explanation is that the port mirror or monitor function is applied BEFORE the VLAN tag operation. On Cisco, for example, they have a command to force this:
From https://www.cisco.com/c/en/us/td/docs/s ... rspan.html.For local SPAN, outgoing packets through the SPAN destination port carry the original encapsulation headers—untagged, ISL, or IEEE 802.1Q—if the encapsulation replicate keywords are specified. If the keywords are not specified, the packets are sent in native form.
Statistics: Posted by robertkjonesjr — Tue Mar 26, 2024 5:31 pm