Could you help me understand this capture?
The capture was made on a Linux host, directly connected to the switch, receiving IKE packets from IPsec.
In the capture I see packets coming without marking and another with marking, with the same checksum and identification.
Am I right?
Your description of the whole setup is a bit ambiguous, therefore I'm going to assume the capture was made on the switch monitor port. In that case you see the VLAN tagged frames on the ingress port and the non-tagged frames on the egress port of the switch. This is the result of a) the egress port being configured to adding/dropping the VLAN tag, and b) your monitor port is configured to mirror all traffic going in and out of the switch.
Thank you for taking the time to answer my question, Jaap.
Unfortunately I didn't capture it on the switch. It was a capture on the ethernet port of the linux host, which in this case is my firewall. This host is virtualized, so it is a virtual network interface.
I was wondering about LACP binding issues that could give this kind of "weirdness" to my capture.
I understand. thanks, gave me some clarity.
When it says "non-standard capture" is it the method I sent?
If there is something I can improve, can you guide me? I'm looking for the forum to give the least amount of effort to employees who donate their time to help.
This would take a much deeper look into all details of your topology and the involved software components to make out why you're seeing this. Standard capture would be a bare metal Linux host (without VMs) where you capture the local traffic on a single Ethernet interface. You've got LACP, a firewall, VLANs and VMs pilled on top of that in some way, and then capture somewhere in there. That's what I call non-standard.
Asked: 2022-12-17 19:40:29 +0000
Seen: 325 times
Last updated: Dec 18 '22
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
