My experience is that Windows NICs/driver tend to not preserve VLAN tags when capturing traffic using WinPcap (for Wireshark). My suggestion is simply to boot a Linux USB key on your box and use Wireshark (or to be honest dumpcap if you are going to be trying to drink from that 10G firehose).
Regards, Martin
MartinVisser99@xxxxxxxxx
On Fri, Sep 3, 2010 at 9:26 PM,
netztier@xxxxxxxxxx <netztier@xxxxxxxxxx> wrote:
Hi all
I know this might not be strictly Wireshark-related, possibly some
of you also came across this issue and
might be able to help - else
just tell me to go bark up another tree... :-)
We're trying to capture traffic from a
SPAN session on a Cisco
Nexus 5020.
- SPAN source (rx only) is a 4x10G Port Channel, with very little traffic.
- SPAN
destination is a 1x 10G port, configured as 802.1q trunk,
(so that it does not strip the VLAN tags away)
The NIC is a
HP NC522SFP (dual 10G, PCI-E 8x) in a HP DL585-something
(2x 6-core Opteron, 32GB RAM) running Windows Server 2008
64bit and
the latest NIC driver available from HP (not sure about the NIC's firmware,
though; as I understood,
Windows drivers are soft-overlaying latest firmware
anyway). It seems that this is an HP OEM product by Qlogic
running
their nx3 Chipset.
Wireshark 1.4.0 however does get to see the VLAN tags. We've been trying
to enable and
disable "VLAN/Priority support" on the NIC, but there seems
to be no change: Tags are not visible to Wireshark.
We
found http://wiki.wireshark.org/CaptureSetup/VLAN#Special_flag_settings,
but the hints there don't seem applicable to
this HP/Qlogic NIC.
Would anyone happen to know the right conflig flag in registry or driver GUIs
to make that NIC
preserve the VLAN tags before handig the frame over to libpcap?
best regards & thanks a lot
Marc
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
