SPAN config - Difficulty seeing 802.1q tagging ?

[dclee]

Well I am definitely a bit frustrated with this one.

My setup is a Catalyst (3560 C3560-IPBASE-M), Version 12.2(35)SE5,

I have a cisco phone with a PC behind it on port gi 0/40

     port config

                    switchport access vlan 5

                    switchport voice vlan 105

Phone gets 105.x ip and PC gets 5.x ip. All is working well.

I am trying to sniff this traffic to ensure vlan tagging and QOS markings by using SPAN.

monitor session 1 source int gi 0/40

monitor session 1 destination int gi 0/3 encapsulation replicate

Can someone confirm that this is the correct config for this ?

Wireshark shows me entire phone conversation but I cannot see any 802.1q tagging..

I also tried to sniff int gi 0/49 as it is my dot1q trunk back to the core and I still cant see any vlan tagging..

Hoping someone can help me out on this one. I have read thru the docs and this should be a easy...

Cheers

Dave

[dclee]

Found the cause, it appears that the Nic driver and XP was stripping off the 802.1q info.

I ended up having to add a line in the registry under the NIC card settings.

Cheers

Dave

[Giuseppe Larosa]

Hello Dave,

we had a similar issue some time ago getting different results with different laptops.

A useful explanation of how to capture vlan tags with wireshark is reported here:

http://wiki.wireshark.org/CaptureSetup/VLAN

It provides the methods to override the vlan tag stripping on windows based PCs (that are different depending on the NIC vendor)

Hope to help

Giuseppe