Wireshark · Ethereal-users: Re: [Ethereal-users] VLAN Traffic

[Guy Harris <gharris@xxxxxxxxx>]

On Thu, May 20, 2004 at 07:22:25PM -0400, M.Okunishi wrote:
> I'm trying to see VLAN(802.1q)traffic on my test environment, so I used
> ethereal to try. But, as default I could not see VLAN which I should see.
> The switch setting looks good, so I wonder if I have to change any setting
> or getting additional driver to see VLAN?

On what OS are you capturing traffic?

Does that OS have both a "raw" Ethernet interface and a "VLAN
interface", so that the "raw" Ethernet interface sees raw Ethernet
packets and the "VLAN interfaces" sees packets that have had the VLAN
header removed and the link-layer type in the Ethernet header changed to
the type from the VLAN header rather than the "VLAN" Ethernet type?

If so, you would need to capture on the "raw" Ethernet interface; if you
capture on a "VLAN interface", you'll probably see only traffic on that
VLAN, and won't see VLAN headers.

> Can anybody advise me or check the attached capture file?

That capture looks as if it was done on a "VLAN interface", as the
link-layer headers look like ordinary Ethernet link-layer headers for IP
(with a link-layer type of 0x0800 for IP) rather than VLAN headers (with
a link-layer type of 0x8100 for VLAN traffic).