Ethereal-users: Re: [Ethereal-users] No H323 conversations decoding with 802.1q frames

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 09 Mar 2005 00:06:29 -0800
Nicolas.CLEMENTZ@xxxxxx wrote:
When I sniff a trunk link (802.1q encapsulation) ethereal cannot detects H323 conversations.
I.e., if you have a capture file with H.323 conversations in it, with 802.1q headers on the Ethernet packets, Ethernet doesn't recognize them as H.323 traffic?
Could you send us a sample capture? That *shouldn't* be happening, as the dissectors for various H.323 protocols shouldn't do anything that's dependent on the link layer.
Also, are you using a capture filter? If so, note that if the filter is checking any fields other than the Ethernet MAC address field, you need to put "vlan" at the beginning of the capture filter - otherwise, the filter will check the Ethernet type field in the Ethernet header, rather than the 802.1q header, and won't recognize, for example, IP traffic.