Ethereal-users: Re: [Ethereal-users] RE: q-in-q

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 10 Dec 2004 11:18:40 -0800
Tiernan, Dan wrote:

I and a colleague are using ethereal 10.4 and wincap 2.3. My colleague can capture and display a q-in-q vlan packet. *See below. *Basically, the metro providers will carry customers tagged vlan traffic and append another VLAN ID header to the original packet, thus reduce the consumption of VLAN ID's in the metro Ethernet network. When I capture the same traffic, all I see is the VLAN ID from the customer (vlan_10) and not Q-IN-Q vlan ID of 1000. Why would I have this problem? I would think that your stack is grabbing the packet off the wire, so is it possible that the my nic card is discriminating the q-in-q id?

It's not our stack, if "we" are the Ethereal developers - it's Microsoft's, the NIC driver vendor's, and the Polito di Torino's stack, and most of it is the NIC driver vendor's and Microsoft's; by the time the packet gets to the WinPcap driver (that's the Polito di Torino's part), the damage has probably already been done.

The WinPcap driver gets the packet from NDIS; that isn't necessarily what comes from the wire - the NIC, the NIC driver, or what VLAN code there is in Windows might be stripping off VLAN headers if you're capturing on a "virtual device" connected to the VLAN rather than on some "raw" device corresponding directly to the NIC:

	http://www.ethereal.com/faq#q5.36