I have an IP Phone that has a machine daisy chained off of the phone. I put a Hub in line with the IP phone and used a laptop to running Wire Shark hoping to capture all traffic on that port. The network port is a trunk port and the voice and data traffic are on separate VLANs. The laptop gets a data IP address (as is expected), but when examining the PCAP I do not see Voice traffic. I only see data traffic. I made sure Promiscuous mode was enabled. I figured I would see all traffic on that port, whether it was voice or data traffic. What am I missing??? Any help would be greatly appreciated. asked 11 Aug '16, 06:46  Kenny70 showing 5 of 6 show 1 more comments |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Is the hub inserted between the phone and the rest of the network or between the IP phone and the machine connected to it?
The Hub is inserted between the phone and the rest of the network.
And are you sure it's really a hub? Many older devices are labeled "switching hub" or "hub", but are in fact switches.
Positive it's a Hub.
In that case, if the hub is really a hub (which doesn't care about the packet types), and if the phone works normally but you just cannot see its traffic on your laptop, I would assume that your laptop's network card driver ignores frames with VLAN tag (ethertype 0x8100) and the data VLAN frames are not tagged at the phone's uplink.
The behaviour of network cards under Windows differs a lot - some let a tagged frame in but strip the VLAN header before WinPcap/NPcap can get its copy, some do not let a tagged frame in at all even if in promiscuous mode. The best ones (from capturing point of view) are configurable.
Thanks for the tip. I'll look into the Network Card and driver.