This is our old Q&A Site. Please post any new questions and answers at

My laptop is Thinkpad T440p, the NIC is Intel(R) Ethernet Connection I217-LM. And my windows operating system is windows 7.
How to Capture Vlan tag. I have set the monitormode =1 and monitormodeenabled=1 under the regedit ControlSet001.

But it still not work.

asked 29 Aug '15, 13:51

Caiser's gravatar image

accept rate: 0%

edited 29 Aug '15, 17:00

Guy%20Harris's gravatar image

Guy Harris ♦♦

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class{4D36E972-E325-11CE-BFC1-08002BE10318} Have you tried CurrentControlSet instead of ControlSet001 ?

(30 Aug '15, 01:16) Christian_R

Are you trying to capture traffic generated from the Thinkpad T440P laptop and expecting to see VLAN tags?

I ask this question because the VLAN is not added by the laptop. The VLAN tag is added by the switch when the traffic enters the network (ingress) and then the switch removes the VLAN when the traffic exists the network (egress).

To examine the VLAN tagged traffic, you could use the laptop to monitor other traffic on your network (i.e., traffic not being generated by the laptop). In this case, you might need to configure the switch to "pass along" the VLAN information. For example, Cisco switches require the following command to be entered in privileged exec mode:

monitor session 1 destination int gi1/0/16 encapsulation dot1q

Noticed the "encapsulation dot1q" at the end. This informs the switch to pass the VLAN tags to the destination monitor port.

permanent link

answered 31 Aug '15, 07:50

Amato_C's gravatar image

accept rate: 14%

Thanks when I turn off the firewall, I can capture the pakcets with VLAN TAG

permanent link

answered 01 Sep '15, 12:28

Caiser's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 29 Aug '15, 13:51

question was seen: 3,008 times

last updated: 01 Sep '15, 12:34

p​o​w​e​r​e​d by O​S​Q​A