On Thu, Jun 06, 2002 at 09:40:37AM +0200, PELLE Thierry FTRD/DAC/ISS wrote:
> I have an ethernet link transporting two 802.1q VLAN frames. I would
> like to capture with one ethernet card and ethereal, but I can't manage
> to do it?
"Can't" in what sense? Do the packets not show up? Are you sniffing on
the raw Ethernet device, or on a VLAN device? On what OS are you
running Ethereal?
The page at
http://scry.wanfear.com/~greear/vlan.html
seems to imply that, on Linux, older versions of the VLAN software
described on that page may not have handled raw packet capture as well
as they should have:
Change Log
Release 1.6 (gz) For Kernel: 2.4.14+ March 24, 2002:
Removed 2.4 kernel patch: It's in the standard kernel now.
Updated vconfig to fix some compile issues, and enable
cross-compilation to the StrongARM platform (changes
should help other cross-compile attempts too.)
Release 1.5 (gz) For Kernel: 2.4.12-pre5 October 22, 2001:
Mostly added other peoples fixes and patches (thanks
folks!)
Finally fixed mc-list leakage (Ard van Breemen)
Flush mc-list at vlan-destory (Ard van Breemen)
Add vconfig man page to distribution (Ard van Breemen)
Fix problem with /proc and renaming VLAN devices (af AT
devcon D.T net)
Add relatively large change by Nick Eggelston that makes
VLAN devices more transparent to tools like tcpdump and
other raw packet snoopers. This will only be enabled when
the REORDER_HDR flag is set.
See also:
http://www.ethereal.com/lists/ethereal-users/200104/msg00022.html
http://www.ethereal.com/lists/ethereal-users/200104/msg00023.html
However, those messages (and the message I quoted in the second of
those) seem to describe the VLAN problems as bad packets being captured,
rather than as *no* packets being captured, so if you're not seeing
VLAN packets at all, it's probably a different problem.