I have following configuration
PC#1 <----> switch <----> PC#2
I configured switch such that PVID =4 (default port VLAN) for both ports. Also, both ports have VLAN 4 assigned and are tagged ports.
Both PC's have Intel NICs with monitoring mode enabled and that works. ie, I can capture RX'd frames and see VLAN tag.
If I use packet generator to send tagged or untagged packets in, I see tagged packet received by other PC as expected.
However, if I ping between the two PC's, the ping fails when wireshark is capturing. If I stop wireshark capture, pings continue fine. If I turn monitor mode off in same config, then pings work fine while wireshark is running.
This doesnt make sense to me since I know the frames being passed back/forth must have VLAN tags when pinging without wireshark capturing (since I see tagged frames with packet generator)
Can you think of any reason why ping would fail between two windows 7 PC's only when wireshark is capturing and NIC is in monitored mode?
asked 29 Jul '14, 10:21
edited 29 Jul '14, 14:17
Guy Harris ♦♦
This Intel support page for "monitor mode" on Ethernet adapters says "This change is only for promiscuous mode/sniffing use."; it might be that, in "monitor mode", the driver configures the adapters not to strip VLAN tags or CRCs, and not to drop bad packets, when in promiscuous mode, under the assumption that a network sniffer is running, but that a consequence of doing so might be that the adapters don't work as normal network adapters when you're in promiscuous mode, and that the driver doesn't configure the adapters that way when not in promiscuous mode, so that the adapter works as a normal network adapter but strips VLAN tags.
I.e., you may be out of luck if you want pings to work and VLAN tags not to be stripped. You might want to ask Intel whether there's any way to get what you want, but the answer might be "no".
answered 29 Jul '14, 14:36
Guy Harris ♦♦