Mix (E-mail) wrote:
> where do I need to look in the sniffer trace for the VLAN ID or TAG value
> I can see the DSCP tag but cant find the VLAN ID or TAG
"Sniffer trace", in the sense of a trace captured with Network
Associates/Network General's Sniffer(R) product, "sniffer trace" in the
sense of a trace you captured with Ethereal (or tcpdump/WinDump), or
"sniffer trace" in the sense of a trace you captured with some other
application?
A packet with a VLAN tag will probably have an Ethernet header, which
should have a destination and source address and an Ethernet type value of
hex 8100, followed by a VLAN header, which includes the VLAN tag and a
type/length value.
If it doesn't have the VLAN header, and has an Ethernet header with an
Ethernet type value other than hex 8100 (for example, hex 0800 for an IP
packet), then some of the hardware or software Ethereal uses to capture
the packets stripped off the VLAN header before handing the packet to the
capture application, so it's not there.
If you were capturing with Ethereal (or tcpdump/WinDump or some other
libpcap/WinPcap-based application), and didn't get VLAN headers, see
http://www.ethereal.com/faq#q7.11
and the Ethereal Wiki item to which it refers.