Wireshark-users: Re: [Wireshark-users] Decoding packets from a Cisco's "ip traffic-export" flow

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Fri, 29 Feb 2008 21:40:27 -0700

On Fri, Feb 29, 2008 at 10:33:42PM -0600, Frank Bulk wrote:

> The packets are showing up in Wireshark my workstation, but the 
> packets aren't decoding to show that they are a ping.  I see the 
> payload of the ping in the data section, but it's like the "ip traffic 
> export" feature added another header.  But the documentation says, 
> "The unaltered IP packets are exported on a single LAN or VLAN 
> interface, thereby, easing deployment of protocol analyzers and 
> monitoring devices."

I haven't used that feature before, but if you would like to attach a 
small capture file (2-3 packets) in a mail to the list, myself or 
someone else could have a look at what the router may be adding.


Steve