Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

HELP: Don't see VLAN header while Sniffing on VSPAN : Thx

Cat6509: Miirroring 2 source ports 6/42 and 6/43 to 1 VSPAN dest port 6/33.

--------------------------------------------------

1. All ports are 100bFull, all ports VLAN is 99, No TRUNKING on ANY port

2. Host on port 6/42 and 6/43 explictly sending VLAN-802.1p/Q VLAN priority

3. Connected Sniffer to VSPAN port 6/33. NIC does not support 802.1p/Q

--------------------------------------------------

Cat6509 switch config as below:

Destination : Port 6/33

Admin Source : Port 6/42-43

Oper Source : Port 6/42-43

Direction : transmit/receive

Incoming Packets: disabled (..) (Refer Q.3 below) ***

Learning : enabled (..) (Refer Q.3 below) ***

Multicast : disabled

Filter : -

Status : active

---------------------------------------------------

Q.1: With above config, Should i expect to see VLAN-802.1p/Q header while Sniffig on VSPAN port ? (If answer is YES then, I do not see VLAN header while Sniffing. If answer is NO then, what changes i have to make and why is reason for changes? (To aware myself)

Q.2: Some rated expert on this forum mentioend that to enable trunking. BUT on which port and why? (Isn't it true that 802.1/Q trunking is used to carry Multi-VLAN traffic which is used for inter-VLAN routing. Well in my case i have only one VLAN=99)

Q3: Any changes on SPAN command like *** "Incoming Packets: disabled" (..), "learning: enabled" ***.

If all above looks OK then is it NIC realted? PL HELP ASAP...Thx

============================

Kal

3 REPLIES

Re: HELP: Don't see VLAN header while Sniffing on VSPAN : Thx

Q1: You will not observe any vlan info. vlan info is only present on trunks. A normal network node does not "understand" the meaning of a tagged frame and will discard it. You can see it as something that's proprietary to trunk links. When you want to sniff the packets that are tagged with 802.1q trunking info, you will obviously need to attach your sniffer to a trunk link.

Q2: True, trunking is used to carry Multi-VLAN traffic. Trunking is needed to distinguish between vlans when the packets for multiple vlans are transported over the same link. The receiving side removes the tagging before passing on the frame.

Q3: I honestly do not know if the trunking info is preserved when the data is copied to a span-port. To be certain to catch it, you could attach a hub with your sniffer between the two sides of a trunk. You may get errors due to duplex mismatches but it should be possible to catch a few frames when the load is not too high.

Bronze

Re: HELP: Don't see VLAN header while Sniffing on VSPAN : Thx

q1, you should not see the dot1q frames if the trunking in not on- please make sure you manually turn off trunking..

q2,, yes you are correct, trunking only supported to carry more than one vlan on the single phyical link

q3- no need to do anything with the span. just make sure trunking is off both on source and destination ports

hope this helps

New Member

Re: HELP: Don't see VLAN header while Sniffing on VSPAN : Thx

Thx for answer

BUT I got confuse on your ans on q1 and q3.

As in q1 you said TUNR-ON trunking and in q3 you said TURN-OFF trunking.

---

Case1: I TRUN-ON the trunking on source and dest port BUT NO LUCK.

Case2: I TURN-OFF trunking on source and dest ports BUT same results.

---

In both cases is sniffer on SPAN dest port. Still, I do not see VLAN header.

Am i missing anything else?

Pl help ASAP, Problem is still not resolved, Thx

187
Views
0
Helpful
3
Replies
CreatePlease login to create content