can?t see the VLANID in ethernetpacket with sniffer

rabeder · ‎04-20-2007

hi,

i have the following setup:

two switches 2960 connected together over a trunked connection (802.1q)

i have two vlans configured in the switch:

vlan 1 (default) and vlan2.

i have a sniffer connected and i am mirroring the port where the two switches are connected to the sniffer.

there is a router connected on a port - this port is an access-port in vlan 2.

if i do a ping from this router over the switch-switch connection, i am not able to see the vlanid in the packet?

the pingsize is only 100 byte

i need this investigation for analysing the cos fields in the vlan-header

thank - any idea ???

royalblues · ‎04-20-2007

Just to ensure you are mirroring the trunk port connection between the switch

cos bytes will be carried only on the trunk links

better would be to put 2 desktops in 2 different vlans and place them across the 2 switches and ping them... you should see the cos bytes

HTH

Narayan

rabeder · ‎04-20-2007

hi,

i opened the switch-switch connection and inserted a hub - so i looked at the right frame - between the two switches.

here you can see the relevant switchkonfig:

interface FastEthernet0/1

switchport access vlan 2

switchport mode access

no logging event link-status

mls qos trust dscp

spanning-tree portfast

!

interface FastEthernet0/3

switchport access vlan 3

switchport mode access

no logging event link-status

spanning-tree portfast

!

interface FastEthernet0/24

switchport trunk allowed vlan 1-3,10,1002-1005

switchport mode trunk

!

on port 0/1 there is the enddevice connected

port 0/24 is the switch-to-switch interlink (over a hub), where i do the sniffering

the enddevice is a router, connected to port 0/1 wich the following config:

!

interface FastEthernet3/1

description to filiale

bandwidth 100000

ip address 30.30.30.1 255.255.255.0

duplex auto

speed auto

max-reserved-bandwidth 100

!

the config from other switch:

!

interface GigabitEthernet0/1

switchport access vlan 2

no logging event link-status

spanning-tree portfast

!

interface GigabitEthernet0/24

switchport trunk allowed vlan 1,2,10,1002-1005

switchport mode trunk

!

fakt is that i can?t see the vlan id on the interswitchlink - i do not know why !

ankbhasi · ‎04-20-2007

Hi Raber,

As Narayan updated I believe you are sniffing the trunk interface?

Also can you post teh output of

"sh run | in monitor"

Regards,

Ankur

rabeder · ‎04-20-2007

hi,

i opened the switch-switch connection and inserted a hub - so i looked at the right frame - between the two switches.

here you can see the relevant switchkonfig:

interface FastEthernet0/1

switchport access vlan 2

switchport mode access

no logging event link-status

mls qos trust dscp

spanning-tree portfast

!

interface FastEthernet0/3

switchport access vlan 3

switchport mode access

no logging event link-status

spanning-tree portfast

!

interface FastEthernet0/24

switchport trunk allowed vlan 1-3,10,1002-1005

switchport mode trunk

!

on port 0/1 there is the enddevice connected

port 0/24 is the switch-to-switch interlink (over a hub), where i do the sniffering

the enddevice is a router, connected to port 0/1 wich the following config:

!

interface FastEthernet3/1

description to filiale

bandwidth 100000

ip address 30.30.30.1 255.255.255.0

duplex auto

speed auto

max-reserved-bandwidth 100

!

the config from other switch:

!

interface GigabitEthernet0/1

switchport access vlan 2

no logging event link-status

spanning-tree portfast

!

interface GigabitEthernet0/24

switchport trunk allowed vlan 1,2,10,1002-1005

switchport mode trunk

!

fakt is that i can?t see the vlan id on the interswitchlink - i do not know why !

royalblues · ‎04-22-2007

friend,

May be these 2 links can answer the behavior you are seeing

http://wiki.ethereal.com/CaptureSetup/VLAN#head-81781716144f2855ab0aff2f8b752e95f2562efb

http://www.ethereal.com/faq#q7.11

HTH, rate if it does

Narayan