Problem with sniffing tagged traffic.

[idata]

Dear all I have a PC and laptop with Intel ethernet microchip's on board. And tried to capture a trunk interface on my cisco switch but unfortunately I couldn't see neither 802.1q nor 802.1p bits in Ethernet header. After reading couple article (http://wiki.wireshark.org/CaptureSetup/VLAN http://wiki.wireshark.org/CaptureSetup/VLAN and http://www.intel.com/support/network/sb/CS-005897.htm http://www.intel.com/support/network/sb/CS-005897.htm) I decided to download new drivers for my PC's. There were appeared some new tabs including VLAN, Lan Speed, Power Management and some advanced options where Priority and Tag could be enabled/disabled. But even after Priority and Tag was enabled my sniffer doesn't see VLAN and QOS tags. Could you please advice how should I set up NIC options to let sniffer to see this tags in ethernet frame?

P.S. some info about my computers: 1) workstation with W7 installed. NIC - Intel(R) 82566DM-2. Driver for NIC version 9.13.16.0

2) laptop with XP SP3. NIC -82566MM. Driver version 9.13.16.0

Monitored link on switch - trunk with dot1q encapsulation using monitor session command

Will be apreciate for any help.

Best regards,

Dmitriy.

[Mark_H_Intel]

The tags are usually stipped out by the dirver, but you can make a registry change to see the tags. The article http://www.intel.com/support/network/sb/cs-005897.htm My sniffer is not seeing VLAN, 802.1q, or QoS tagged frames explains how to make the changes. You already gave this link before, so I think you are on the right track. In some drivers the registry change did not allow the tags to be passed. I think most of the drivers have that feature working now, but make sure you are using the latest driver version.

[idata]

Hi Mark. Thanks for your reply. But I tried this way with registry changing. Without any success. Besides this there are no my network adapters in the list of adapters which the changing could be applied to. That is why I'm asking here

Best regards,

Dmitriy

[Mark_H_Intel]

If I understand your question correctly, the problem is not seeing VLAN information when monitoring on your switch. I have zero experience configuring these switches other than some classes a long time ago. Nevertheless, I think the reason you are not seeing the tags is because the tags are being stripped from the port where you are doing the monitoring. I can't help you properly configure your switch to see the tags, but I found an article that might help you with the configuration.

http://www.netinst.com/support/osup1052.html Network Instruments Document Number OSUP105

This article describes an issue that sounds like the one you are describing. Although the article applies to a Networks Instruments analyzer, the contents should apply no matter what sniffer you are using for monitoring.

I hope this helps.

Mark