From: Kal Han (calikali2006@gmail.com)
Date: Mon Aug 14 2006 - 01:41:06 ART
It depends on the host on which your sniffer is running.
If you are using Windows PC, I know it works fine with the Intel Pro
NIC card with their (Intel) drivers.
I remember, one person at work had the same problem.
This problem could be because of a driver issue or the
NIC itself. Some drivers REMOVE dot1q tags.
Try to see if there are any driver updates availabe for your NIC card.
Thanks
Kal
On 7/31/06, secondie <secondie@gmail.com> wrote:
>
> Setup
>
> I have switch1 and 2 connected via port 1with Q trunk configured (all
> vlans allowed)
> Switch 1 has router R1 connected to port 20.
> Switch 2 has router R2 connected to port 20.
>
> Every thing is on VLAN 20 and both routers can ping each other.
>
> R1 -- SW1 -- fa0/1 -- trunk -- fa0/1 -- SW2 ---R2
>
>
> I am trying to config span source as port 1 on sw1, destination on sw 1
> is port 48
>
> when I configure
>
> monitor sess 1 source int fa 0/1
> monitor sess 1 dest int fa 0/48
>
> or
>
> monitor session 1 source interface Fa0/1
> monitor session 1 destination interface Fa0/48 ingress vlan 20
>
> I can see ping on sniffer
>
> but when I configure
>
> monitor sess 1 source int fa 0/1
> monitor sess 1 dest int fa 0/48 encap dot1q
>
> or
>
> monitor sess 1 source int fa 0/1
> monitor sess 1 dest int fa 0/48 encap dot1q ingress vlan 20
>
> FAILS ...... I see nothing on sniffer.
>
> Any one see problem with this ?
>
> How can I see dot1q tags on the traffic? Any scenarios?
>
> TIA
> -secondie
This archive was generated by hypermail 2.1.4 : Fri Sep 01 2006 - 15:41:57 ART