1

I have spent the last few hours trying to capture some trunk packets so I can see and examine the dot1q VLAN field. I have tried mirroring the trunk port to my PC using the following commands on Cisco 2960PD switch;

sh run | s mon
monitor session 1 source interface Fa0/6
monitor session 1 destination interface Fa0/4 encapsulation replicate

This has allowed me to capture the packets however I do not see the dot1q field as if the tag has been stripped out. I have tried some new drivers with my network adapter and I have tried changing the 'Priority and VLAN' setting to 'Priority and VLAN disabled' on my network adapter with no luck. Any ideas?

Improve this question
5
  • 3
    Far too many NICs (and drivers) internally process tags, so the OS never gets to see them.
    – Ricky
    Jun 1, 2020 at 5:57
  • 2
    Very often, there's a registry setting for the NIC to expose Q tags, see wiki.wireshark.org/CaptureSetup/VLAN
    – Zac67 ♦
    Jun 1, 2020 at 6:59
  • Priority and VLAN disabled probably means 802.1q disabled. The priority and VLAN terminology is a good description of 802.1q. So, you should probably NOT disable that option.
    – Jeff Wheeler
    Jun 1, 2020 at 17:32
  • Actually, 802.1Q tags are on the ethernet frames, not the IP packets..
    – Ron Maupin ♦
    Jul 3, 2020 at 3:24
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 16, 2020 at 23:20

1 Answer 1

Reset to default
1

I was able to achieve the desired outcome by using a Mikrotik routerboard and getting the trunk to run through it. I used the packet sniffer function which saved the capture to a file and I was able to download the file to my PC and view it with Wireshark. The 802.1Q field was a sight for sore eyes :).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.