From: Joseph Brunner (joe@affirmedsystems.com)
Date: Fri Mar 28 2008 - 22:29:32 ART
Good points, Jian Gu. But what if you use span with the "encapsulation
replicate" option, or are using a tap interface, so you are capture without
span?
I have heard that certain vendor cards running dot1q software ( in cases
where you want a server to play in multiple vlans) the "processing is done
below the stack" hence why even in promiscuous mode the tag removal was done
already by the nic.
I will use your advice, and just put span destination ports as trunks, but
wont "monitor" mode, supercede "switchport mode trunk"
Thank you!
Joe
_____
From: Jian Gu [mailto:guxiaojian@gmail.com]
Sent: Friday, March 28, 2008 6:49 PM
To: Joseph Brunner
Cc: Sadiq Yakasai; Cisco certification
Subject: Re: VLAN Tag on Wirieshark capture
This is not true, when you run Ethereal or Wireshark on a NIC, it turns the
NIC to promiscuous mode, NIC card will not know whether the Ethernet frames
it receives are tagged or not.
The reason you don't see VLAN tags in capture software is because SPAN on
Cisco switches only copies only Layer 2 Ethernet frames, SPAN does not copy
source trunk port ISL or 802.1Q tags. You can configure destination ports as
trunks to send locally tagged traffic to the traffic analyzer.
On Fri, Mar 28, 2008 at 9:33 AM, Joseph Brunner <joe@affirmedsystems.com>
wrote:
You need a nic card which doesn't strip them off... try the INTEL instead of
the broadcom cards or search the hacki site to get the model.
Joe
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
Sadiq Yakasai
Sent: Friday, March 28, 2008 10:16 AM
To: Cisco certification
Subject: VLAN Tag on Wirieshark capture
Hi Guys,
Please how can I view the VLAN tags on a wireshark capture for dot1q frames?
I have done the capture, but the information I see when the capture
application decodes all the information but doesnt not include the
VLAN tags of the actual frames.
I know there has to be a way to get this information, but just not
seeing it. I have done a few seaches online and cant lay a finger on
any useful information.
Any help would be highly appreciated.
Thanks!!
Sadiq
This archive was generated by hypermail 2.1.4 : Tue Apr 01 2008 - 07:53:54 ART