3

How can I monitor on a Cisco router if dot1Q packets arrive on the trunk interface or if others arrive on that interface (like ISL, the old protocol of Cisco)?

How can I do this and what is the best way to do this? Can it be done via monitoring or through the use of ACL's or debugging options? This would be handy for troubleshooting.

  • 2
    Does your router support Embedded Packet Capture(EPC). What model and IOS are you running? – Daniel Dib Oct 11 '13 at 6:57
  • @DanielDib I'll look it up and get back to you. – Bulki Oct 14 '13 at 6:28
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 14:59
2

If your router supports span ports you can anaylze the traffic using Wireshark. Wireshark understands both ISL and dot1q, for more information:

Wireshark ISL reference http://www.wireshark.org/docs/dfref/i/isl.html

An example of a capture containing both techniques: http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=isl-2-dot1q.cap

  • Hi Robert, thx for your answer but how can this be done remotely from another site (no physical access)? Is it possible to send this to an IP address on another site? (site: physical location, different subnet) – Bulki Oct 14 '13 at 6:28
  • You'll need a layer two connection if you want to mirror the traffic. Otherwise information like vlan-tags and mac-addresses has been changed because of the intermediate routing hop. – Robert Oct 14 '13 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.