Ethereal-users: Re: [Ethereal-users] Can't capture VLAN Frame

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 15 Oct 2003 14:53:38 -0700

On Oct 15, 2003, at 10:54 AM, Tse Andrew-ATSE1 wrote:

I use Linksys Gigabit Ethernet card in Win2000 Pro, and couldn't able to capture VLAN packets.

What do you mean by "capture VLAN packets"? Do you mean you can't capture any packets at all, or that you are only seeing packets on your VLAN and aren't seeing VLAN headers on the packets?

 Does anyone know why

At least on some UNIX systems, I have the impression that if the machine is on a VLAN and the VLAN stuff isn't being handled entirely on the network interface device, the host will have two network interface "devices" that the software sees:

	1) a raw Ethernet device;

	2) a device for the VLAN.

The networking stacks would receive packets from the VLAN device and send packets to the VLAN device; however, at least on some of those systems, it might be possible to capture packets on either of the devices. If you capture on the VLAN device, you would probably see only packets from the VLAN, and wouldn't see the VLAN header; if you capture on the raw device, you'd see all the packets the interface device would see, and packets for VLANs would have a VLAN header.

However, I don't know how that works on Windows. It might be that there's only a VLAN device, in which case you might only be able to capture packets from your VLAN and won't see the VLAN headers.