This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capturing VLAN Tags with Intel Pro/1000 CT NIC Card

0

Hi,

I am running CentOS 6.2 using the default e1000 driver for my Intel Pro/1000 CT Gb NIC card.

I am running Dumpcap to capture packets from this interface.

I am seeing NO packets being captured.

I looked at this site: http://wiki.wireshark.org/CaptureSetup/VLAN

I was unable to determine a resolution for issue.

Any guidance or assistance will be greatly appreciated.

Thanks,

John

asked 30 Oct '12, 12:06

xq1's gravatar image

xq1
0224
accept rate: 100%

edited 30 Oct '12, 12:44

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237


2 Answers:

0

Problem Solved - added MTU="9000" to /etc/sysconfig/network-scripts/ifcfg-ethx

Thanks Kurt for your time!

answered 31 Oct '12, 11:55

xq1's gravatar image

xq1
0224
accept rate: 100%

As it turns out this solution does NOT make the change permanent.

(01 Nov '12, 11:12) xq1

0

There are discussions on the internet about the e1000 driver and VLAN handling. Taking these into account, I have some questions and some suggestions:

Questions:

  • do you capture on ethx or on ethx.100 (VLAN tag 100)?
  • if you capture on ethx (eth0,eth1,etc.) is there any VLAN interface configured?
  • what do you see if you run this command: tcpdump -ni eth0 vlan?

Suggestions:

  • If there is a VLAN interface configured (e.g. ethx.100) the e1000 driver seems to handle VLAN tags in a different way, than if there is no VLAN interface. I suggest to remove the VLAN interface and then capture on the interface ethx, if that is possible in your environment.
  • Can you please post the output of the command: modinfo -d -p e1000?

Regards
Kurt

answered 30 Oct '12, 12:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Hi Kurt,

Below are the answers to your questions.

Any guidance to troubleshooting and resolving is greatly appreciated.

-John

=======================

None of my interfaces are set up with VLAN subinterfaces (ie eth1.100)

=======================

tcpdump -ni eth1 vlan - produces no output

=======================

tcpdump -ni eth1 vlan

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes

=======================

modinfo -d -p e1000 output

=======================

modinfo -d -p e1000

debug:Debug level (0=none,...,16=all)

copybreak:Maximum size of packet that is copied to a new buffer on receive

KumeranLockLoss:Enable Kumeran lock loss workaround

SmartPowerDownEnable:Enable PHY smart power down

InterruptThrottleRate:Interrupt Throttling Rate

RxAbsIntDelay:Receive Absolute Interrupt Delay

RxIntDelay:Receive Interrupt Delay

TxAbsIntDelay:Transmit Absolute Interrupt Delay

TxIntDelay:Transmit Interrupt Delay

XsumRX:Disable or enable Receive Checksum offload

FlowControl:Flow Control setting

AutoNeg:Advertised auto-negotiation setting

Duplex:Duplex setting

Speed:Speed setting

RxDescriptors:Number of receive descriptors

TxDescriptors:Number of transmit descriptors

(30 Oct '12, 16:03) xq1

ethtool -i eth1

driver: e1000e

version: 1.9.5-k

firmware-version: 1.8-0

bus-info: 0000:20:00.0

(30 Oct '12, 16:05) xq1

I noticed the driver loaded for this NIC is actually e1000e so here is the output for e1000e:

modinfo -d -p e1000e

EEE:Enable/disable on parts that support the feature

CrcStripping:Enable CRC Stripping, disable if your BMC needs the CRC

WriteProtectNVM:Write-protect NVM [WARNING: disabling this can lead to corrupted NVM]

KumeranLockLoss:Enable Kumeran lock loss workaround

SmartPowerDownEnable:Enable PHY smart power down

IntMode:Interrupt Mode

InterruptThrottleRate:Interrupt Throttling Rate

RxAbsIntDelay:Receive Absolute Interrupt Delay

RxIntDelay:Receive Interrupt Delay

TxAbsIntDelay:Transmit Absolute Interrupt Delay

TxIntDelay:Transmit Interrupt Delay

copybreak:Maximum size of packet that is copied to a new buffer on receive

(30 Oct '12, 16:07) xq1

lspci output:

20:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection

30:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection

(30 Oct '12, 16:10) xq1