wireshark capture packets in promiscuous mode

If the OS or the network adapter driver won't allow the VLAN tags to be captured, set up port mirroring (or 'port spanning', as Cisco calls it) on the VLAN switch and connect an independent system, such as a laptop, to the mirror port, and don't configure the interface attached to that port as a member of a VLAN. Here are some details on capturing VLAN tags on various operating systems. On those OSes, in order to see the raw Ethernet packets, rather than 'de-VLANized' packets, you would have to capture not on the virtual interface for the VLAN, but on the interface corresponding to the physical network device, if possible. The OS's networking stack would be connected to the VLAN interface, and that interface would appear to the networking stack to be an Ethernet interface with a smaller MTU than normal (to leave room for the VLAN tags).

When capturing on a VLAN, you won't necessarily see the VLAN tags in packets.įor example, in at least some operating systems, you might have more than one network interface device on which you can capture - a 'raw interface' corresponding to the physical network adapter, and a 'VLAN interface' the traffic on which has had the VLAN tags removed. Marvell Yukon 88E8055 PCI-E Gigabit Ethernet Controller.Broadcom Advanced Server Program (BASP).

Wireshark capture packets in promiscuous mode