Wireshark · Ethereal-users: Re: [Ethereal-users] No H323 conversations decoding with 802.1q frames

[Guy Harris <gharris@xxxxxxxxx>]

Nicolas.CLEMENTZ@xxxxxx wrote:

> When I sniff a trunk link (802.1q encapsulation) ethereal cannot detects 
> H323 conversations.

I.e., if you have a capture file with H.323 conversations in it, with 
802.1q headers on the Ethernet packets, Ethernet doesn't recognize them 
as H.323 traffic?

Could you send us a sample capture?  That *shouldn't* be happening, as 
the dissectors for various H.323 protocols shouldn't do anything that's 
dependent on the link layer.

Also, are you using a capture filter?  If so, note that if the filter is 
checking any fields other than the Ethernet MAC address field, you need 
to put "vlan" at the beginning of the capture filter - otherwise, the 
filter will check the Ethernet type field in the Ethernet header, rather 
than the 802.1q header, and won't recognize, for example, IP traffic.