SPAN config - Difficulty seeing 802.1q tagging ?

Unanswered Question

Well I am definitely a bit frustrated with this one.

My setup is a Catalyst (3560 C3560-IPBASE-M), Version 12.2(35)SE5,

I have a cisco phone with a PC behind it on port gi 0/40

     port config

                    switchport access vlan 5

                    switchport voice vlan 105

Phone gets 105.x ip and PC gets 5.x ip. All is working well.

I am trying to sniff this traffic to ensure vlan tagging and QOS markings by using SPAN.

monitor session 1 source int gi 0/40

monitor session 1 destination int gi 0/3 encapsulation replicate

Can someone confirm that this is the correct config for this ?

Wireshark shows me entire phone conversation but I cannot see any 802.1q tagging..

I also tried to sniff int gi 0/49 as it is my dot1q trunk back to the core and I still cant see any vlan tagging..

Hoping someone can help me out on this one. I have read thru the docs and this should be a easy...



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Giuseppe Larosa Sun, 02/14/2010 - 00:52
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Dave,

we had a similar issue some time ago getting different results with different laptops.

A useful explanation of how to capture vlan tags with wireshark is reported here:

It provides the methods to override the vlan tag stripping on windows based PCs (that are different depending on the NIC vendor)

Hope to help



This Discussion