Wireshark can capture whatever comes across its interface(s). So if you're able to bring the various vlans to the capture interface(s) it could be captured. How you do that is another matter. It could be through a span port, it could be several local interfaces. It all depends on the specifics of your capture environment.
Just one more point, technically Wireshark does not capture directly but using a capture library which differs per operating system, and the library hooks into the network stack at a place where the network card driver could already have modified the received packet. So e.g. on Microsoft Windows, you may not see the VLAN headers even though they were úhysically present on the wire because the some drivers strips them. Likewise, the npcap capture library was stripping vlan headers some months ago, I'm not sure what is the current state.
Now if the question was how safe the devices in one VLAN are against being sniffed by some other devices, it also depends on the network topology and position of the sniffing device.
Asked: 2018-05-03 15:42:43 +0000
Seen: 776 times
Last updated: May 03 '18
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
