Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

vlan tag capturing

I've been trying to capture the vlan tags on a trunk link using the wireshark and port mirroring with no success. Any ideas on what I'm doing wrong or what I'm missing .

4 REPLIES

Re: vlan tag capturing

You should be looking for packets with ethertype 8100. Check the link for a wiki on this:

http://en.wikipedia.org/wiki/IEEE_802.1Q#Frame_format

Setting the monitor port to trunk mode is an experiment that's certainly worth trying. However, even if you are doing everything correctly, your PC adapter may not recognize the packets and ignore them.

regards,

Leo

Community Member

Re: vlan tag capturing

The monitor port has to be configured as a trunk port and the NIC has to support vlan tags.

I've got a Dell laptop with an integrated Broadcom ethernet NIC that doesn't let me capture vlan tags. I ended up getting a Trendnet 10/100/1000 PC card to use w/ wireshark so that I could see the vlan tags.

Community Member

Re: vlan tag capturing

I do have the monitor port as trunk. Since I'm running linux I'm gone try tcpdump instead of wireshark.

Community Member

Re: vlan tag capturing

Ok, I've got it working. Had to install module 8021q on linux and update my monitor session to

monitor session 2 destination interface Gi1/0/3 encapsulation dot1q

577
Views
0
Helpful
4
Replies
CreatePlease to create content