I am investigating some CPEs that might not be properly tagging frames. What can I use to reliably capture the raw packet with 802.1q tag? It becomes a problem because the driver/firmware might be stripping the tag before the packet is passed on to wireshark/tcpdump.
The same goes with generating tagged traffic. How can I know for sure the frames sent out on the wire are actually tagged when I generate QinQ frames with Ostinato, but the OS driver (such as Windows 10 + Intel ANT) doesn't even support VLAN features.
The NICs I am using are all Intel (i340-T4 etc). The CPE in question are some Mikrotik RB4xx/7xx with Atheros switching chip and some unmanaged switches (testing how they handled tagged frames). I suspect there are some bugs in switch chip tagging that's why I don't decided to take a look into what's actually being sent/received. From what I have read most Intel NICs process VLAN tags in hardware and do not pass it up.