0

I have spent the last few hours trying to capture some trunk packets so I can see and examine the dot1q VLAN field. I have tried mirroring the trunk port to my PC using the following commands on Cisco 2960PD switch;

sh run | s mon
monitor session 1 source interface Fa0/6
monitor session 1 destination interface Fa0/4 encapsulation replicate

This has allowed me to capture the packets however I do not see the dot1q field as if the tag has been stripped out. I have tried some new drivers with my network adapter and I have tried changing the 'Priority and VLAN' setting to 'Priority and VLAN disabled' on my network adapter with no luck. Any ideas?

  • 3
    Far too many NICs (and drivers) internally process tags, so the OS never gets to see them. – Ricky Beam Jun 1 at 5:57
  • 2
    Very often, there's a registry setting for the NIC to expose Q tags, see wiki.wireshark.org/CaptureSetup/VLAN – Zac67 Jun 1 at 6:59
  • Priority and VLAN disabled probably means 802.1q disabled. The priority and VLAN terminology is a good description of 802.1q. So, you should probably NOT disable that option. – Jeff Wheeler Jun 1 at 17:32
  • Actually, 802.1Q tags are on the ethernet frames, not the IP packets.. – Ron Maupin Jul 3 at 3:24
0

I was able to achieve the desired outcome by using a Mikrotik routerboard and getting the trunk to run through it. I used the packet sniffer function which saved the capture to a file and I was able to download the file to my PC and view it with Wireshark. The 802.1Q field was a sight for sore eyes :).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.