Skip to content
This repository has been archived by the owner on Apr 14, 2023. It is now read-only.

Importing pcap with 802.1q encapsulation results in no data #26

Open
jraber opened this issue May 6, 2019 · 0 comments
Open

Importing pcap with 802.1q encapsulation results in no data #26

jraber opened this issue May 6, 2019 · 0 comments
Assignees
Labels

Comments

@jraber
Copy link

jraber commented May 6, 2019

Steps to reproduce:

  1. Setup a SPAN session a Cisco switch with an 802.1q trunk as the source and with the destination option 'encapsulation replicate'
interface GigabitEthernet1/0/1
 description A Trunk Port
 switchport mode trunk
end

monitor session 1 source interface Gi1/0/1
monitor session 1 destination interface Gi1/0/2 encapsulation replicate
  1. Use dumpcap to capture that data.
  2. Load that pcap in grassmarlin and notice that either no or very few hosts are listed. The only hosts listed are those that passed unencapsulated data (eg for spanning tree or CDP)
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

4 participants