1

I am investigating some CPEs that might not be properly tagging frames. What can I use to reliably capture the raw packet with 802.1q tag? It becomes a problem because the driver/firmware might be stripping the tag before the packet is passed on to wireshark/tcpdump.

The same goes with generating tagged traffic. How can I know for sure the frames sent out on the wire are actually tagged when I generate QinQ frames with Ostinato, but the OS driver (such as Windows 10 + Intel ANT) doesn't even support VLAN features.

The NICs I am using are all Intel (i340-T4 etc). The CPE in question are some Mikrotik RB4xx/7xx with Atheros switching chip and some unmanaged switches (testing how they handled tagged frames). I suspect there are some bugs in switch chip tagging that's why I don't decided to take a look into what's actually being sent/received. From what I have read most Intel NICs process VLAN tags in hardware and do not pass it up.

Improve this question
3
  • Then use NICs that don't do that crap. (really, that's the only option, unless you have register level access to a switch that can change the tpid -- so it doesn't know it's dot1q)
    – Ricky
    Feb 11, 2016 at 6:09
  • It's not usually the role of a CPE to tag frames. They would in most cases send/receive untagged frames, and the switch will tag the frames when forwarding them onto a trunk (a link using tagging), or vice-versa, based on the tag associated with the port. As for capturing the full frame, do you plan on doing that on a device directly connected to the "offending" device, or through a switch? What OS and Ethernet card are you planning to use? Is VLAN tagging active on the NIC?
    – jcaron
    Feb 11, 2016 at 15:00
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin ♦
    Aug 7, 2017 at 14:25

4 Answers 4

Reset to default
2

Windows has no built-in support mechanisms for VLANs. There aren't separate physical and VLAN interfaces you can capture from, unless a specialized driver that adds such support is present.

So whether you see VLAN tags in Wireshark or not will depend on the network adapter you have and on what it and its driver do with VLAN tags.

Most "simple" network adapters (e.g. widely used Realtek RTL 8139) and their drivers will simply pass VLAN tags to the upper layer to handle these. In that case, Wireshark will see VLAN tags and can handle and show them.

Some more sophisticated adapters will handle VLAN tags in the adapter and/or the driver. This includes some Intel adapters and, as far as i know, Broadcom gigabit chipsets (NetXtreme / 57XX based chips). Moreover, it is likely that cards that have specialized drivers will follow this path as well, to prevent interference from the "real" driver.

source

On a cisco switches diffrent models needs diffrent config. for example at destination interface encapsulation dot1q needs to be added this will allow switch copy vlan tags to output port.

Improve this answer
1
1

By client, do you mean a host like a PC?. Most don't understand VLAN tags, and the switch ports to which it is connected is probably an access ports which doesn't send VLAN tags, anyway. If you have a host that does send VLAN tags, you need to make sure that it is connected to a trunk port which allows that VLAN.

Typically, you use what the switch has built in to see VLANs from the trunks. This varies by switch model. Managed switches will tag VLANs on the trunks if properly configured. You need to make sure that the trunks are set to allow all the VLANs which you are expecting.

Improve this answer
2
  • 1
    It's extremely common these days for NICs to "help" by removing the VLAN tag and realigning the packet. It's absolutely infuriating. (I've been so motivated by some chips/drivers to actually program the switch to use something other than 0x8100)
    – Ricky
    Feb 11, 2016 at 6:15
  • @RickyBeam I happy to not meet such NIC. May be it problem of Windows 10 driver? What if try some Live Linux for capture? So Wireshark on Windows 8.1 capture tagged and QinQ tagged well. Im specially do it to test how Mikrotik make VLAN tagging.
    – mmv-ru
    Aug 10, 2016 at 19:06
1

You need to be sure that you are connected to a trunk port, only with this you will receive tagged frames. On that way, you can connect your PC and with wireshark, sniff the traffic with IP 0.0.0.0, it means ALL traffic. I think you can take your traffic and see what you want with this scenario.

Improve this answer
0

It shouldn't be impossible since you essentially have the same problem with WLAN-cards, they also hide all the ugly business with WiFi from the OS, and only give it the ethernet frames. But there's still software available that let's you see all the WiFi specific packet info.

Check how different NICs handle VLAN tagging when you generate packages. A lot of NICs these days have VLAN support, and they should be your best bet if you want to generate traffic with VLAN tags, since they obviously know how to tag traffic correctly.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.