[GRLUG] Capturing mirrored traffic from a trunk port

[Michael Mol]

On Tue, Jul 20, 2010 at 3:46 PM, Adam Tauno Williams
<awilliam at whitemice.org> wrote:
> I have a Cisco 2960GTC switch where port X is a trunk port (multiple
> vLANs run between this port and subinterfaces on a Cisco 7200).  However
> when I capture this traffic to port Y -
>
> (config)#monitor session 1 source interface Gi0/X both
> (config)#monitor session 1 destination interface Gi0/Y
>
> - I believe I see all the traffic, but packets do not appear to have
> vLAN 802.1q tags.  I'm capturing the traffic with Wireshark v1.2.1
>
> I've tried setting Gi0/Y to switchport trunk mode, to no effect.
>
> Do I need to do something on the switch or is it possible the ethernet
> interface on the Linux workstation is stripping the tags?

Is your kernel configured with 802.1q support? You may want to check that.

-- 
:wq

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.