topic Re: Wireshark Packets no VLAN in Switches, Hubs, and Modems

Wireshark Packets no VLAN

PEI_1 — Thu, 17 Feb 2011 01:34:04 GMT

Hi,
Trying to capture 802.1q with Wireshark but no prevail.
I have 2 test computers connected to 2 Procurve 2610 each on Port 1. Both switches are connected to each other on Port 3. Port 1 and 3 of both switches are on VLAN 300, tagged. Both test computers have Intel Proset installed. They are connecting to the switches on virtual interface VLAN 300.

My wireshark PC is connected to port 48 on one of the switches. port 48 is untag on Vlan1. The PC uses NIC "Local Area Connection" (not VLAN) to connect to the switch. Port 48 is set to monitorring port, port 3 is the monitoring source.

have someone managed to capture packets vlan info with Wireshark?

Re: Wireshark Packets no VLAN

Jeff Carrell — Fri, 02 Sep 2011 19:56:42 GMT

check this thread:
http://h30499.www3.hp.com/t5/Switches-Hubs-Modems-Legacy-ITRC/Problem-with-basic-VLANs-and-tagging-on-ProCurve-2626/m-p/5247109#M29683

When I have had this issue, it was related to mods required in driver config...see my first post in this thread for links.

hth...Jeff

ps, when the drivers are working on the wireshark pc, it is not required to have that nic nor the switch port it is connected to in tagged state. If there is a tagged pkt going to the wireshark port, it will pass through.

Re: Wireshark Packets no VLAN

PEI_1 — Thu, 17 Feb 2011 10:05:45 GMT

Thanks Jeff.

I can't find {4D36E972-E325-11CE-BFC1-08002BE10318} under HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\. Please advise.

How do I know if my Intel NIC is PCI/PCI-X or PCI-e based?

Thanks
Pei

Re: Wireshark Packets no VLAN

Jeff Carrell — Thu, 17 Feb 2011 13:54:52 GMT

PEI asked: "I can't find {4D36E972-E325-11CE-BFC1-08002BE10318} under HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\. Please advise.

How do I know if my Intel NIC is PCI/PCI-X or PCI-e based?
"

I've also seen this, I kept looking at the ControlSetxxx until I found one that had the info I needed to change/modify....it has been awhile since I've done this.

Those notes are not always "exact".

I've also updated the drivers and it made it easier to support these functions. (as noted in the other thread)

When using a lapto for wireshark and capturing 802.1Q frames, I've also installed a different NIC sometimes (PCMCIA or ExpressCard)...gotta keep trying things till it all works...it is not an exacting science, sometimes more hit-n-miss, but it works for me..

To tell if PCI/PCI-X/PCI-e, I either look at the properties of the lan interface or lookup the lan interface on the manufacturers website.

hth...Jeff

Re: Wireshark Packets no VLAN

Pieter 't Hart — Fri, 18 Feb 2011 08:01:03 GMT

>>> port 48 is untag on Vlan1<<<

the monitoring port will not behave as a q-in-q trunk!
so vlan-tags will be stripped before any packet is sent out to the port on vlan1!

if you want your packets sent out tagged, you'll need to tag the port for each additional vlan you need to monitor.

Re: Wireshark Packets no VLAN

PEI_1 — Fri, 18 Feb 2011 10:26:18 GMT

Thanks Jeff, I solved the problem today, the 2 links you provided is the key:

http://wiki.wireshark.org/CaptureSetup/VLAN
http://www.intel.com/support/network/sb/CS-005897.htm (My PC uses INTEL Nic)

I found the registry entry and added the DWORD, set it to value 1. Restart PC, Wireshark displayed 802.1q priority nicely.

I do not have to tag the monitoring port, also do not need to use a virtual Nic for my wireshark PC to connect to the monitoring port.

Another thing about monitoring port, the packets were sent to the monitoring port before they were sent to egress. As the packets were monitored before they were applied with VLAN priority, the packets priority was 0 on Wireshark. I have configured a VLAN priority on SW1.

I changed my monitoring port from SW1 to SW2, monitored on the connecting port on SW2. Ping from the PC attached to SW1 to the PC attached to SW2. I could see the packet priority set for the direction from SW1 to SW2. Can't remember the reply packet if still preserve the priority. As both connecting ports and ports attached to PCs are tagged with the same VLAN, I am expecting the reply packets from SW2 to SW1 would have the same VLAN priority.

Also turned on qos type-of-service diff-services, the default priority 7 for DSCP 46 appears nicely on incoming packets.

How do I trace my submitted questions on this forum?

Have a nice weekend.
Pei