I have spent the last few hours trying to capture some trunk packets so I can see and examine the dot1q VLAN field. I have tried mirroring the trunk port to my PC using the following commands on Cisco 2960PD switch;
sh run | s mon monitor session 1 source interface Fa0/6 monitor session 1 destination interface Fa0/4 encapsulation replicate
This has allowed me to capture the packets however I do not see the dot1q field as if the tag has been stripped out. I have tried some new drivers with my network adapter and I have tried changing the 'Priority and VLAN' setting to 'Priority and VLAN disabled' on my network adapter with no luck. Any ideas?