The OS is WIN2KPRO. Which interface do I use to caputure and see VLAN
traffic, "raw" or "VLAN interface"?
Thanks in advance for your input
-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx
[mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Friday, May 21, 2004 2:51 AM
To: Ethereal user support
Subject: Re: [Ethereal-users] VLAN Traffic
On Thu, May 20, 2004 at 07:22:25PM -0400, M.Okunishi wrote:
> I'm trying to see VLAN(802.1q)traffic on my test environment, so I
> used ethereal to try. But, as default I could not see VLAN which I
> should see. The switch setting looks good, so I wonder if I have to
> change any setting or getting additional driver to see VLAN?
On what OS are you capturing traffic?
Does that OS have both a "raw" Ethernet interface and a "VLAN interface", so
that the "raw" Ethernet interface sees raw Ethernet packets and the "VLAN
interfaces" sees packets that have had the VLAN header removed and the
link-layer type in the Ethernet header changed to the type from the VLAN
header rather than the "VLAN" Ethernet type?
If so, you would need to capture on the "raw" Ethernet interface; if you
capture on a "VLAN interface", you'll probably see only traffic on that
VLAN, and won't see VLAN headers.
> Can anybody advise me or check the attached capture file?
That capture looks as if it was done on a "VLAN interface", as the
link-layer headers look like ordinary Ethernet link-layer headers for IP
(with a link-layer type of 0x0800 for IP) rather than VLAN headers (with a
link-layer type of 0x8100 for VLAN traffic).
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users