This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

wrong vlan outer tag shown?

I am doing dot1q tunnel and I use double tagging. I tag the frame with outer vlan 220, but in Wireshark, it shows vlan 1195.

Is it any conversion from 220 to 1195? or what i am seeing is not the outer vlan? Thanks!

the photo is attached: https://docs.google.com/file/d/0B6xwIiuptf5NZl90V0dlWWIzUUU/edit

vlan id

asked 08 Nov '12, 00:22

bennettfan
6●2●2●4
accept rate: 0%

edited 08 Nov '12, 07:16

Jaap ♦
11.7k●16●101

can you please post that single packet in pcap format on cloudshark.org?

(08 Nov '12, 01:01) Kurt Knochner ♦

i don't know why i can not upload there. I just upload to google. https://docs.google.com/open?id=0B6xwIiuptf5NZk83cEZrNG5lMzQ

can you see it?

(08 Nov '12, 01:26) bennettfan

unfortunately that's not in pcap format (it's some hex dump). How did you capture the packet and how did you generate the hex dump? I need the packet in pcap format to analyze it with Wireshark.

(08 Nov '12, 01:31) Kurt Knochner ♦

how about this file? I use wireshark to print out the packet and save it.

https://docs.google.com/open?id=0B6xwIiuptf5NVE5QVGk2ODZ6Q0E

(08 Nov '12, 01:39) bennettfan

Same format :-). Please Export the packet like this:

Mark the packet. Click on it then press CTRL-M
Wireshark 1.6: File -> Save as -> Marked Packets
Wireshark 1.8: File -> Export Specified Packets -> Marked Packets

(08 Nov '12, 01:56) Kurt Knochner ♦

http://cloudshark.org/captures/8607aff92c7b

^^THX

(08 Nov '12, 02:15) bennettfan

showing 5 of 6 show 1 more comments

2 Answers:

Wireshark only shows what is in the packet. In your first/real sample there are two 32 Bit 802.1q VLAN tag fields added:

Outer Tag: 24ac8100
Inner Tag: 20c6ffff

According to the 802.1q standard, those values contain this:

http://en.wikipedia.org/wiki/IEEE_802.1Q
http://www.cisco.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080094665.shtml

16 Bit Tag Protocol Identifier (TPID)
16 Bit Tag Control Identifier (TCI), where the last 12 Bits are the VLAN tag

Outer Tag

TPID = 0x8100 (Tagged frame)
TCI = 0x24ac. Last 12 Bits: 010010101100 == 4AC == 1196

Inner Tag

TPID = 0xffff HINT: This should be 0x800 if the remainder is an ethernet frame. 0xfff is kind of strange/wrong
TCI = 0x20c6. Last 12 Bits: 000011000110 == C6 == 198

So, as you can see Wireshark just shows what is in the packet. If that is not what you expected, there is either a problem with the part that generated that packet or the tool that captured the packet (and wrote it to a pcap file).

Regards
Kurt

answered 08 Nov '12, 19:45

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 08 Nov '12, 19:47

Noted. Thanks so much^^

(08 Nov '12, 20:36) bennettfan

If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(09 Nov '12, 01:59) Kurt Knochner ♦

Wireshark shows a straight interpretation of the packet data it sees. Like shown on the screenshot and the packet shown through cloudshark, it is double tagged, but it seems you define the inner tag or something, not the outer.

answered 08 Nov '12, 07:19

Jaap ♦
11.7k●16●101
accept rate: 14%

Below is the double tagging layer 2 frame generated by JDSU and I just post it. The outer vlan 4000 and inner vlan 50 is clearly shown. http://cloudshark.org/captures/2e701df8b958

Can anyone tell more about is it any problem with the below frame? is it the outer vlan wrong ? what is it? http://cloudshark.org/captures/8607aff92c7b

(08 Nov '12, 19:27) bennettfan