|
It might be worth searching the net for registry
settings. Most Windows NICs need a new DWORD added before they can capture
802.1Q VLAN headers.
Sent: Saturday, September 04, 2010 8:10 AM
Subject: Re: [Wireshark-users] HP/Qlogic 10G NIC (Windows): driver
config to preserve VLAN tags?
My experience is that Windows NICs/driver tend to not preserve
VLAN tags when capturing traffic using WinPcap (for Wireshark). My suggestion is
simply to boot a Linux USB key on your box and use Wireshark (or to be honest
dumpcap if you are going to be trying to drink from that 10G firehose).
Regards, Martin MartinVisser99@xxxxxxxxx
On Fri, Sep 3, 2010 at 9:26 PM, netztier@xxxxxxxxxx <netztier@xxxxxxxxxx> wrote:
Hi all
I know this might not be strictly
Wireshark-related, possibly some
of you also came across this issue
and
might be able to help - else
just tell me to go bark up another
tree... :-)
We're trying to capture traffic from a
SPAN
session on a Cisco
Nexus 5020.
- SPAN source (rx only) is a 4x10G
Port Channel, with very little traffic.
- SPAN
destination is a 1x 10G
port, configured as 802.1q trunk,
(so that it does not strip the VLAN tags
away)
The NIC is a
HP NC522SFP (dual 10G, PCI-E 8x) in a HP
DL585-something
(2x 6-core Opteron, 32GB RAM) running Windows Server
2008
64bit and
the latest NIC driver available from HP (not sure about
the NIC's firmware,
though; as I understood,
Windows drivers are
soft-overlaying latest firmware
anyway). It seems that this is an HP OEM
product by Qlogic
running
their nx3 Chipset.
Wireshark 1.4.0
however does get to see the VLAN tags. We've been trying
to enable
and
disable "VLAN/Priority support" on the NIC, but there seems
to be no
change: Tags are not visible to Wireshark.
We
found http://wiki.wireshark.org/CaptureSetup/VLAN#Special_flag_settings,
but
the hints there don't seem applicable to
this HP/Qlogic NIC.
Would
anyone happen to know the right conflig flag in registry or driver GUIs
to
make that NIC
preserve the VLAN tags before handig the frame over to
libpcap?
best regards & thanks a
lot
Marc
___________________________________________________________________________
Sent
via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:
http://www.wireshark.org/lists/wireshark-users
Unsubscribe:
https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
___________________________________________________________________________
Sent
via: Wireshark-users mailing list
<wireshark-users@xxxxxxxxxxxxx>
Archives:
http://www.wireshark.org/lists/wireshark-users
Unsubscribe:
https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
|