can?t see the VLANID in ethernetpacket with sniffer

Unanswered Question
Apr 20th, 2007
User Badges:

hi,

i have the following setup:

two switches 2960 connected together over a trunked connection (802.1q)

i have two vlans configured in the switch:

vlan 1 (default) and vlan2.


i have a sniffer connected and i am mirroring the port where the two switches are connected to the sniffer.


there is a router connected on a port - this port is an access-port in vlan 2.


if i do a ping from this router over the switch-switch connection, i am not able to see the vlanid in the packet?

the pingsize is only 100 byte

i need this investigation for analysing the cos fields in the vlan-header


thank - any idea ???

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (2 ratings)
Loading.
royalblues Fri, 04/20/2007 - 00:29
User Badges:
  • Green, 3000 points or more

Just to ensure you are mirroring the trunk port connection between the switch


cos bytes will be carried only on the trunk links


better would be to put 2 desktops in 2 different vlans and place them across the 2 switches and ping them... you should see the cos bytes


HTH

Narayan

rabeder Fri, 04/20/2007 - 02:21
User Badges:

hi,

i opened the switch-switch connection and inserted a hub - so i looked at the right frame - between the two switches.


here you can see the relevant switchkonfig:


interface FastEthernet0/1

switchport access vlan 2

switchport mode access

no logging event link-status

mls qos trust dscp

spanning-tree portfast

!

interface FastEthernet0/3

switchport access vlan 3

switchport mode access

no logging event link-status

spanning-tree portfast

!

interface FastEthernet0/24

switchport trunk allowed vlan 1-3,10,1002-1005

switchport mode trunk

!

on port 0/1 there is the enddevice connected

port 0/24 is the switch-to-switch interlink (over a hub), where i do the sniffering


the enddevice is a router, connected to port 0/1 wich the following config:

!

interface FastEthernet3/1

description to filiale

bandwidth 100000

ip address 30.30.30.1 255.255.255.0

duplex auto

speed auto

max-reserved-bandwidth 100

!

the config from other switch:

!

interface GigabitEthernet0/1

switchport access vlan 2

no logging event link-status

spanning-tree portfast

!

!

interface GigabitEthernet0/24

switchport trunk allowed vlan 1,2,10,1002-1005

switchport mode trunk

!



fakt is that i can?t see the vlan id on the interswitchlink - i do not know why !

ankbhasi Fri, 04/20/2007 - 01:04
User Badges:
  • Cisco Employee,

Hi Raber,


As Narayan updated I believe you are sniffing the trunk interface?


Also can you post teh output of


"sh run | in monitor"


Regards,


Ankur

rabeder Fri, 04/20/2007 - 02:22
User Badges:

hi,

i opened the switch-switch connection and inserted a hub - so i looked at the right frame - between the two switches.


here you can see the relevant switchkonfig:


interface FastEthernet0/1

switchport access vlan 2

switchport mode access

no logging event link-status

mls qos trust dscp

spanning-tree portfast

!

interface FastEthernet0/3

switchport access vlan 3

switchport mode access

no logging event link-status

spanning-tree portfast

!

interface FastEthernet0/24

switchport trunk allowed vlan 1-3,10,1002-1005

switchport mode trunk

!

on port 0/1 there is the enddevice connected

port 0/24 is the switch-to-switch interlink (over a hub), where i do the sniffering


the enddevice is a router, connected to port 0/1 wich the following config:

!

interface FastEthernet3/1

description to filiale

bandwidth 100000

ip address 30.30.30.1 255.255.255.0

duplex auto

speed auto

max-reserved-bandwidth 100

!

the config from other switch:

!

interface GigabitEthernet0/1

switchport access vlan 2

no logging event link-status

spanning-tree portfast

!

!

interface GigabitEthernet0/24

switchport trunk allowed vlan 1,2,10,1002-1005

switchport mode trunk

!



fakt is that i can?t see the vlan id on the interswitchlink - i do not know why !

Actions

This Discussion