Could you please tell me how to configure Ethernet card for capturing vlan tag packet with wireshark? My ethernet card is the "Realtek PCIe GBE Family Controller" in WINDOWS 7. I have download the latest drivers and the utility software. with the utility network software i have te possibility to set vlan id in the port but the wireshark isn't able to capture vlan id (I Send ethernet frames with 1518 bytes packet size and the wireshark captures 1514 bytes. the 4 bytes for vlan tagging don't appear). thanks

asked 31 Aug '11, 06:38

akalavri's gravatar image

akalavri
1223
accept rate: 0%

edited 31 Aug '11, 06:40

Hello,

I have the same "Realtek PCIe GBE Family Controller" in Windows 7 Home Premium, driver 7.67.1226.2012. I have disabled the setting "Priority & VLAN" and the Wireshark is NOT able to capture the Vlan ID. Thanks for the answers!

(07 Mar '13, 02:22) Josemi

The "Realtek PCIe GBE Family Controller" NIC can be configured to not strip the vlan tags, by going to the Adapter Settings and setting "Priority & VLAN" to "Priority & VLAN disabled". All the other values for this option will make the driver delete the VLAN tags from the frame.

link

answered 31 Aug '11, 10:25

SYN-bit's gravatar image

SYN-bit ♦♦
15.0k848219
accept rate: 19%

I disabled the setting "Priority & VLAN" and the Wireshark is able to capture the Vlan ID. Thanks for the answers!

(04 Sep '11, 02:23) akalavri

I changed your answer to a comment to keep the nature of Q&A going. You might want to accept SYNbits answer by using the checkmark button to the left to mark it as accepted.

(04 Sep '11, 02:59) Jasper ♦

The Realtek cards I have usually allow capturing of VLAN tags without any problems, and it shouldn't be necessary to set any VLAN id on the capture card itself.

If you're saying you're only getting 1514 bytes I'd guess it's an untagged frame without the FCS (Ethernet checksum), not the VLAN header - which would mean, you can't capture VLAN tags because there weren't any. If you're capturing on a SPAN port you probably have to tell the switch to include VLAN tags in the spanned data (on Cisco devices you can do that by telling it to include the "encapsulation dot1q" when creating the span session). Otherwise the switch will strip the VLAN header before copying it to the SPAN output port.

link

answered 31 Aug '11, 06:45

Jasper's gravatar image

Jasper ♦
16.1k338212
accept rate: 17%

edited 31 Aug '11, 06:46

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×43
×5
×4

Asked: 31 Aug '11, 06:38

Seen: 28,809 times

Last updated: 04 Nov '13, 03:05

powered by OSQA