<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16441" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>I am using Tshark supplied with Wireshark
V0.10.5 and trying to use a capture filter when a monitoring a Cisco Catalyst
2950 span port.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">It is a Cisco Catalyst 2950EI
running IOS version 12.1(20EA2)</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <?xml:namespace prefix = o
ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">I am trying to span a trunk port
and look at 802.1Q VLAN headers, but if I specify a valid capture filter of host
10.10.10.10 no packets are captured. I have found it only affects Tshark when
the encapsulation dot1q is added to the destination interface of a monitor
session. The problem would seem to be with WinPcap (tried versions 3.1 and 4.0)
as Netasyst is fine.</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> </P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">Let me explain in more
detail:-</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> </P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">Interface fa0/24 on the Catalyst
2950EI is a 802.1Q trunk to another 2950EI and interface fa0/4 is where the
TShark PC is connected to. Using this span session:-.</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">monitor session 1 source
interface fa0/24</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">monitor session 1 destination
interface fa0/4</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">This works OK with:-</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">tshark -i 3</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">or</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">tshark -i 3 -f "host
10.10.10.10"</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">If the monitor session is changed
to include the encapsulation of dot1q:-</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">monitor session 1 source
interface fa0/24</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">monitor session 1 destination
interface fa0/4 encapsulation dot1q</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">This works OK with:-</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">tshark -i 3</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">but no packets are captured
with:-</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">tshark -i 3 -f "host
10.10.10.10"</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">With Netasyst using the same IP
address as a capture filter e.g. to include IP 10.10.10.10 to any</P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt">It captures fine with or without
the encapsulation dot1q </P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> </P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"><FONT face=Arial size=2>Any
Ideas?</FONT></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"><FONT face=Arial
size=2></FONT> </P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"><FONT face=Arial size=2>Keith
French.</FONT></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P>
<P class=MsoNormal
style="MARGIN: 0cm 0cm 0pt"> <o:p></o:p></P></DIV></BODY></HTML>