Maybe I should have specified a little bit more.
Source:
Router(config)#monitor session 1 source interface GigabitEthernet 6/1
both
Destination:
Router(config)#monitor session 1 destination interface GigabitEthernet
4/48
Destination port config:
Router(config)#interface gi4/48
Router(config)#switchport
Router(config)#switchport trunk encapsulation dot1q
Router(config)#switchport mode trunk
Router(config)#switchport nonegotiate
-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Steve
Bertrand
Sent: Thursday, July 10, 2008 9:42 AM
To: wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] Capturing VLAN tags with Wireshark
Hi everybody,
I've got a handful of VLANs (802.1q) running over a Cisco infrastructure
and I'm trying to capture the Ethernet frames on a switch trunk port
while retaining the VLAN information contained within.
From what I can tell, in order to be able to do a port monitor on a
Catalyst switch to sniff VLAN traffic, I have to assign the monitor port
as a switchport access within a specific VLAN. I assume that when I do
it this way, the VLAN tag is being stripped off before the monitor port
hands off the packet to Wireshark. Is this correct?
Am I missing something obvious? I'd just like to be able to monitor ALL
traffic that is ingress/egress on a specific trunk port for all allowed
VLANs on that trunk, all the while retaining the VLAN information within
the frame.
Thanks for any advice.
Steve
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users
