3

How can I monitor on a Cisco router if dot1Q packets arrive on the trunk interface or if others arrive on that interface (like ISL, the old protocol of Cisco)?

How can I do this and what is the best way to do this? Can it be done via monitoring or through the use of ACL's or debugging options? This would be handy for troubleshooting.

Improve this question
3
  • 2
    Does your router support Embedded Packet Capture(EPC). What model and IOS are you running?
    – Daniel Dib
    Oct 11, 2013 at 6:57
  • @DanielDib I'll look it up and get back to you.
    – Bulki
    Oct 14, 2013 at 6:28
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 8, 2017 at 14:59

1 Answer 1

Reset to default
2

If your router supports span ports you can anaylze the traffic using Wireshark. Wireshark understands both ISL and dot1q, for more information:

Wireshark ISL reference http://www.wireshark.org/docs/dfref/i/isl.html

An example of a capture containing both techniques: http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=isl-2-dot1q.cap

Improve this answer
2
  • Hi Robert, thx for your answer but how can this be done remotely from another site (no physical access)? Is it possible to send this to an IP address on another site? (site: physical location, different subnet)
    – Bulki
    Oct 14, 2013 at 6:28
  • You'll need a layer two connection if you want to mirror the traffic. Otherwise information like vlan-tags and mac-addresses has been changed because of the intermediate routing hop.
    – Robert
    Oct 14, 2013 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.