Ethereal-users: RE: [Ethereal-users] Can't capture VLAN Frame

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Tse Andrew-ATSE1 <Andrew.Tse@xxxxxxxxxxxx>
Date: Wed, 15 Oct 2003 17:01:48 -0500
I setup the Windows and Solaris 9 in same VLAN group, then using the HP advisor to capture packet between the Gigabit switch and Solaris machine, I can see the VLAN packet from HP advisor, but not in ethereal.  

In the Windows side, I specified the same VLAN in the card's properties. 

Andrew Tse
Motorola, Inc. 
Phone: (847)576-3950
Skytel Pager: (888)611-2182


-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxxxx] 
Sent: Wednesday, October 15, 2003 4:54 PM
To: Tse Andrew-ATSE1
Cc: Ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Can't capture VLAN Frame


On Oct 15, 2003, at 10:54 AM, Tse Andrew-ATSE1 wrote:

> I use Linksys Gigabit Ethernet card in Win2000 Pro, and couldn't able 
> to capture VLAN packets.

What do you mean by "capture VLAN packets"?  Do you mean you can't 
capture any packets at all, or that you are only seeing packets on your 
VLAN and aren't seeing VLAN headers on the packets?

>  Does anyone know why

At least on some UNIX systems, I have the impression that if the 
machine is on a VLAN and the VLAN stuff isn't being handled entirely on 
the network interface device, the host will have two network interface 
"devices" that the software sees:

	1) a raw Ethernet device;

	2) a device for the VLAN.

The networking stacks would receive packets from the VLAN device and 
send packets to the VLAN device; however, at least on some of those 
systems, it might be possible to capture packets on either of the 
devices.  If you capture on the VLAN device, you would probably see 
only packets from the VLAN, and wouldn't see the VLAN header; if you 
capture on the raw device, you'd see all the packets the interface 
device would see, and packets for VLANs would have a VLAN header.

However, I don't know how that works on Windows.  It might be that 
there's only a VLAN device, in which case you might only be able to 
capture packets from your VLAN and won't see the VLAN headers.