Re: HP/Qlogic 10G NIC (Windows): driver config to preserve VLAN tags?

[Martin Visser <martinvisser99 () gmail com>]

Thanks Keith, my ignorance is showing. There does seem to be some info at
http://wiki.wireshark.org/CaptureSetup/VLAN#Special_flag_settings about
enabling VLAN tag capture. Unfortunately no help there for Qlogic/NetXen
NICs though.

Regards, Martin

MartinVisser99 () gmail com


On Sun, Sep 5, 2010 at 12:56 AM, Keith French <keithfrench () btconnect com>wrote:

>  It might be worth searching the net for registry settings. Most Windows
> NICs need a new DWORD added before they can capture 802.1Q VLAN headers.
>
>  *From:* Martin Visser <martinvisser99 () gmail com>
> *Sent:* Saturday, September 04, 2010 8:10 AM
> *To:* netztier () bluewin ch ; Community support list for Wireshark<wireshark-users () wireshark org>
> *Subject:* Re: [Wireshark-users] HP/Qlogic 10G NIC (Windows): driver
> config to preserve VLAN tags?
>
> My experience is that Windows NICs/driver tend to not preserve VLAN tags
> when capturing traffic using WinPcap (for Wireshark). My suggestion is
> simply to boot a Linux USB key on your box and use Wireshark (or to be
> honest dumpcap if you are going to be trying to drink from that 10G
> firehose).
>
> Regards, Martin
>
> MartinVisser99 () gmail com
>
>
> On Fri, Sep 3, 2010 at 9:26 PM, netztier () bluewin ch <netztier () bluewin ch>wrote:
>
> > Hi all
> >
> > I know this might not be strictly Wireshark-related, possibly some
> > of you also came across this issue and
> > might be able to help - else
> > just tell me to go bark up another tree...  :-)
> >
> > We're trying to capture traffic from a
> > SPAN session on a Cisco
> > Nexus 5020.
> >
> > - SPAN source (rx only) is a 4x10G Port Channel, with very little traffic.
> > - SPAN
> > destination is a 1x 10G port, configured as 802.1q trunk,
> > (so that it does not strip the VLAN tags away)
> >
> > The NIC is a
> > HP NC522SFP (dual 10G, PCI-E 8x) in a HP DL585-something
> > (2x 6-core Opteron, 32GB RAM) running Windows Server 2008
> > 64bit and
> > the latest NIC driver available from HP (not sure about the NIC's
> > firmware,
> > though; as I understood,
> > Windows drivers are soft-overlaying latest firmware
> > anyway). It seems that this is an HP OEM product by Qlogic
> > running
> > their nx3 Chipset.
> >
> > Wireshark 1.4.0 however does get to see the VLAN tags. We've been trying
> > to enable and
> > disable "VLAN/Priority support" on the NIC, but there seems
> > to be no change: Tags are not visible to Wireshark.
> >
> > We
> > found  http://wiki.wireshark.org/CaptureSetup/VLAN#Special_flag_settings,
> > but the hints there don't seem applicable to
> > this HP/Qlogic NIC.
> >
> > Would anyone happen to know the right conflig flag in registry or driver
> > GUIs
> > to make that NIC
> > preserve the VLAN tags before handig the frame over to libpcap?
> >
> > best regards & thanks a lot
> >
> > Marc
> >
> >
> >
> >
> > ___________________________________________________________________________
> > Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> > Archives:    http://www.wireshark.org/lists/wireshark-users
> > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> >             mailto:wireshark-users-request () wireshark org
> > ?subject=unsubscribe
>
>  ------------------------------
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
>
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe