3 Replies Latest reply on Nov 18, 2009 10:28 AM by mark_h_@intel

    Problem with sniffing tagged traffic.


      Dear all I have a PC and laptop with Intel ethernet microchip's on board. And tried to capture a trunk interface on my cisco switch but unfortunately I couldn't see neither 802.1q nor 802.1p bits in Ethernet header. After reading couple article (http://wiki.wireshark.org/CaptureSetup/VLAN and http://www.intel.com/support/network/sb/CS-005897.htm) I decided to download new drivers for my PC's. There were appeared some new tabs including VLAN, Lan Speed, Power Management and some advanced options where Priority and Tag could be enabled/disabled. But even after Priority and Tag was enabled my sniffer doesn't see VLAN and QOS tags. Could you please advice how should I set up NIC options to let sniffer to see this tags in ethernet frame?


      P.S. some info about my computers: 1) workstation with W7 installed. NIC - Intel(R) 82566DM-2. Driver for NIC version

                                                            2) laptop with XP SP3. NIC -82566MM. Driver version
      Monitored link on switch  - trunk with dot1q encapsulation using monitor session command


      Will be apreciate for any help.

      Best regards,


        • 1. Re: Problem with sniffing tagged traffic.

          The tags are usually stipped out by the dirver, but you can make a registry change to see the tags. The article My sniffer is not seeing VLAN, 802.1q, or QoS tagged frames explains how to make the changes. You already gave this link before, so I think you are on the right track. In some drivers the registry change did not allow the tags to be passed. I think most of the drivers have that feature working now, but make sure you are using the latest driver version.

          • 2. Re: Problem with sniffing tagged traffic.

            Hi Mark. Thanks for your reply. But I tried this way with registry changing. Without any success. Besides this there are no my network adapters in the list of adapters which the changing could be applied to. That is why I'm asking here


            Best regards,


            • 3. Re: Problem with sniffing tagged traffic.

              If I understand your question correctly, the problem is not seeing VLAN information when monitoring on your switch. I have zero experience configuring these switches other than some classes a long time ago. Nevertheless, I think the reason you are not seeing the tags is because the tags are being stripped from the port where you are doing the monitoring. I can't help you properly configure your switch to see the tags, but I found an article that might help you with the configuration.

              Network Instruments Document Number OSUP105

              This article describes an issue that sounds like the one you are describing. Although the article applies to a Networks Instruments analyzer, the contents should apply no matter what sniffer you are using for monitoring.


              I hope this helps.