Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
You may experience some slow load times, errors, and slight inconsistencies. We ask for your patience as we finalize the launch. Thank you.

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Unknown sniffed data from IDS sensor 4215

Hi all, when i snoop from my IDS, all the data i snoop was like the following... why is it like that?

anyone can help?

thanks!

? -> * ETHER Type=8100 (Unknown), size = 149 bytes

? -> * ETHER Type=8100 (Unknown), size = 212 bytes

? -> * ETHER Type=8100 (Unknown), size = 149 bytes

? -> * ETHER Type=8100 (Unknown), size = 212 bytes

? -> * ETHER Type=8100 (Unknown), size = 149 bytes

? -> * ETHER Type=8100 (Unknown), size = 212 bytes

? -> * ETHER Type=8100 (Unknown), size = 64 bytes

? -> * ETHER Type=8100 (Unknown), size = 594 bytes

? -> * ETHER Type=8100 (Unknown), size = 594 bytes

? -> * ETHER Type=8100 (Unknown), size = 594 bytes

  • Other Security Subjects
3 REPLIES
Bronze

Re: Unknown sniffed data from IDS sensor 4215

This basically indicates that frames being looked at are of a feature which is not supported. If you are running IOS 12.1, the reason would be that all the frames to the SPAN destination port come with 802.1Q tag which SNOOP does not support. You could use a sniffer to check the same.

Cisco Employee

Re: Unknown sniffed data from IDS sensor 4215

8100 is the 802.1Q vlan tag type. Snoop does not understand vlan tagging. Try something like tcpdump and ethereal or some other "real" sniffer.

SC

PS. the IDS understands 802.1Q tagging...

New Member

Re: Unknown sniffed data from IDS sensor 4215

On the same topic, what does the following sniffed data represent???

? -> (multicast) ETHER Type=0000 (LLC/802.3), size = 52 bytes

and

? -> (multicast) ETHER Type=2000 (Unknown), size = 388 bytes

159
Views
5
Helpful
3
Replies