This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.
2
1

We are trying to capture VLAN tagged packets on a Cisco Catalyst 3750. We have a VoIP phone that boots on our DATA VLAN and gets settings pushed to it from DHCP Scope option 242. One of these options tells the phone to boot on the VoIP VLAN.

Anyways, I've been doing a simple "monitor session" on the Cisco Catalyst for this but it doesn't appear we're seeing all of the VLAN tagged data. Our vendor suggests the best solution is to break out and use a hub. I tend to agree, but would like to know if I was over-looking a capture option on the Cisco platform.

thanks, Geoff

asked 15 Sep '10, 14:01

GeoffP's gravatar image

GeoffP
40237
accept rate: 0%


In order for the 3750 to keep vlan tags when spanning a trunk port, you need to add encapsulation replicate when configuring your destination port.

Of course you also need to make sure that your capturing device does not strip the tags. See: http://wiki.wireshark.org/CaptureSetup/VLAN

Cheers, Sake


From http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.1_19_ea1/configuration/guide/swspan.html:

However, when you enter the encapsulation replicate keywords when configuring a destination port, these changes occur:

•Packets are sent on the destination port with the same encapsulation—untagged, IEEE 802.1Q, or Inter-Switch Link (ISL)—that they had on the source port.

•Packets of all types, including BPDU and Layer 2 protocol packets are monitored.

Therefore, a local SPAN session with encapsulation replicate enabled can have a mixture of untagged, 802.1Q, and ISL tagged packets appear on the destination port.

permanent link

answered 15 Sep '10, 14:08

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 15 Sep '10, 14:42

Hi Geoff,

In addition to this you may also need to configure your OS/Driver to pass the Vlan tag to Wireshark. How to do this see http://wiki.wireshark.org/CaptureSetup/VLAN

regards Oliver

permanent link

answered 15 Sep '10, 14:38

Oliver's gravatar image

Oliver
91116
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×66
×43
×5

question asked: 15 Sep '10, 14:01

question was seen: 21,170 times

last updated: 15 Sep '10, 14:42

p​o​w​e​r​e​d by O​S​Q​A