brentb2 wrote:
does ethereal support 802.1p and 802.1q capture
What do you mean by "802.1p and 802.1q capture"?
I think at least some OSes, when a network interface is on a VLAN, will
have two separate OS-level devices for the interface - one "raw"
interface for packets delivered to the machine's MAC address and one
"VLAN" interface for packets tagged for the VLAN the interface is on.
If you capture on the "raw" device (if the OS supports that), it might
capture all packets sent to the machine's MAC address, as well as
broadcast and multicast packets, and, for VLAN-tagged packets, might
deliver the packets complete with the VLAN header. If, however, the
interface supports VLANs itself, rather than leaving it up to the driver
and other parts of the networking stack on the host OS, you might not be
able to capture on the "raw" device, if it even exists.
If you capture on the "VLAN" device, you might see only packets on the
VLAN the interface is on, and it might remove the VLAN header from the
packets.
I don't know which OSes do that, if any, nor, if any do, do I know what
the names for the devices in question are.