Tiernan, Dan wrote:
I and a colleague are using ethereal 10.4 and wincap 2.3. My colleague
can capture and display a q-in-q vlan packet. *See below. *Basically,
the metro providers will carry customers tagged vlan traffic and append
another VLAN ID header to the original packet, thus reduce the
consumption of VLAN ID's in the metro Ethernet network.
When I capture the same traffic, all I see is the VLAN ID from the
customer (vlan_10) and not Q-IN-Q vlan ID of 1000.
Why would I have this problem? I would think that your stack is grabbing
the packet off the wire, so is it possible that the my nic card is
discriminating the q-in-q id?
It's not our stack, if "we" are the Ethereal developers - it's
Microsoft's, the NIC driver vendor's, and the Polito di Torino's stack,
and most of it is the NIC driver vendor's and Microsoft's; by the time
the packet gets to the WinPcap driver (that's the Polito di Torino's
part), the damage has probably already been done.
The WinPcap driver gets the packet from NDIS; that isn't necessarily
what comes from the wire - the NIC, the NIC driver, or what VLAN code
there is in Windows might be stripping off VLAN headers if you're
capturing on a "virtual device" connected to the VLAN rather than on
some "raw" device corresponding directly to the NIC:
http://www.ethereal.com/faq#q5.36
