Skip to content
This repository was archived by the owner on Apr 14, 2023. It is now read-only.

Importing pcap with 802.1q encapsulation results in no data #26

@jraber

Description

@jraber

Steps to reproduce:

  1. Setup a SPAN session a Cisco switch with an 802.1q trunk as the source and with the destination option 'encapsulation replicate'
interface GigabitEthernet1/0/1
 description A Trunk Port
 switchport mode trunk
end

monitor session 1 source interface Gi1/0/1
monitor session 1 destination interface Gi1/0/2 encapsulation replicate
  1. Use dumpcap to capture that data.
  2. Load that pcap in grassmarlin and notice that either no or very few hosts are listed. The only hosts listed are those that passed unencapsulated data (eg for spanning tree or CDP)

Metadata

Metadata

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions