2

I have spent the last few hours trying to capture some trunk packets so I can see and examine the dot1q VLAN field. I have tried mirroring the trunk port to my PC using the following commands on Cisco 2960PD switch;

sh run | s mon
monitor session 1 source interface Fa0/6
monitor session 1 destination interface Fa0/4 encapsulation replicate

This has allowed me to capture the packets however I do not see the dot1q field as if the tag has been stripped out. I have tried some new drivers with my network adapter and I have tried changing the 'Priority and VLAN' setting to 'Priority and VLAN disabled' on my network adapter with no luck. Any ideas?

Improve this question
5
  • 3
    Far too many NICs (and drivers) internally process tags, so the OS never gets to see them.
    – Ricky
    Commented Jun 1, 2020 at 5:57
  • 2
    Very often, there's a registry setting for the NIC to expose Q tags, see wiki.wireshark.org/CaptureSetup/VLAN
    – Zac67 ♦
    Commented Jun 1, 2020 at 6:59
  • Priority and VLAN disabled probably means 802.1q disabled. The priority and VLAN terminology is a good description of 802.1q. So, you should probably NOT disable that option.
    – Jeff Wheeler
    Commented Jun 1, 2020 at 17:32
  • Actually, 802.1Q tags are on the ethernet frames, not the IP packets..
    – Ron Maupin ♦
    Commented Jul 3, 2020 at 3:24
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 16, 2020 at 23:20

2 Answers 2

Reset to default
1

I was able to achieve the desired outcome by using a Mikrotik routerboard and getting the trunk to run through it. I used the packet sniffer function which saved the capture to a file and I was able to download the file to my PC and view it with Wireshark. The 802.1Q field was a sight for sore eyes :).

Improve this answer
1

If you have a Realtek network adapter, try this:

  1. Open Device Manager.
  2. Find your network adapter and click on it to open the settings.
  3. Click on the Advanced tab.
  4. Click on Priority & VLAN.
  5. Set it to Priority & VLAN Disabled.
  6. Restart Wireshark and try again.

It's counter-intuitive, but it worked for me and quite a few other people.

Update:

I just did this again for a second device. This one required the steps above, as well as the following:

  1. Open the following path on your Registry Editor: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4d36e972-e325-11ce-bfc1-08002be10318}
  2. Go through the network device entries numbered 00nn till you find your network adapter.
  3. Set the MonitorModeEnabled to 1.
  4. Restart your PC.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.