URGENT! VLAN tags not showing on port mirroring...

[N4DAR]

Well...the title speaks for itself...In fact i have a school project (Triple Play with FTTH) and i wanted to check if my vlans are corrects. So i tried port mirroring with the cisco catayst 3750 we had, and i ended up having ALL the trafic from my trunked port (what i wanted) but without any vlan tags. I added the encapsulation dot1Q command but it didnt work. Is there someone out there that can give me a solution pls? (not to mention that in 2 weeks i have to present this project).

[Mark Malone · Accepted solution]

Sometimes on windows it can be the NIC the fact you set the switchport to encaps command is what you do there is nothing else required on switch side so it may not be a switch issue but rather the NIC if your span is set correctly

If you want to check your vlans you could do it with show vlan and show int trunk

https://wiki.wireshark.org/CaptureSetup/VLAN

Windows

Windows has no built-in support mechanisms for VLANs. There aren't separate physical and VLAN interfaces you can capture from, unless a specialized driver that adds such support is present.

So whether you see VLAN tags in Wireshark or not will depend on the network adapter you have and on what it and its driver do with VLAN tags.

Most "simple" network adapters (e.g. widely used Realtek RTL 8139) and their drivers will simply pass VLAN tags to the upper layer to handle these. In that case, Wireshark will see VLAN tags and can handle and show them.

Some more sophisticated adapters will handle VLAN tags in the adapter and/or the driver. This includes some Intel adapters and, as far as i know, Broadcom gigabit chipsets (NetXtreme / 57XX based chips). Moreover, it is likely that cards that have specialized drivers will follow this path as well, to prevent interference from the "real" driver.

[N4DAR]

(Already saw this link) Yeah i need to reformulate my request: i wanted to check if the datas were in the right vlan. I have tried on several computers (my laptop and the room's computers which have 2 interfaces). I even tried to lauch wireshark with linux but unfortunately, none of the interfaces were recognized.

[N4DAR]

Here are some screenshots of the config and the result...

[Mark Malone]

you need to set encapsulation replicate did you do that or just encapsulation ?

[Mark Malone]

any luck using replicate is it showing the tags

[N4DAR]

...ok... In fact, i had to modify a variable in my NIC register. So yeah, you were right....