![]() Just quoting Cisco website:įor RSPAN, the original VLAN ID is lost because it is overwritten by the RSPAN VLAN identification. It turned out to be a limitation of the RSPAN feature. ![]() That driven me nuts before I understood the cause (tried to re-install NIC drivers, read Wireshark FAQ, tampered with Windows Registry). Although, I have changed Windows 7 registry settings to support Monitor Mode on Intel 82577LM Gigabit NIC, Wireshark was not able to see 802.1q headers of the remote frames captured from the trunk port. I was able to collect a lot of useful data from the remote ports with except to one particular case – it’s when remote port was in a trunking mode configured to trust CoS. Being a lazy guy and to avoid floor walking, I decided to use RSPAN on my Catalyst 3750 switches. I had to do a lot of traffic captures recently.
0 Comments
Leave a Reply. |