• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1662
  • Last Modified:

HP Procurve mirroring

I use Procurve 2900G. I want to capture traffic of port21.  Port1 is mirrorportPort and I can capture traffic of port 21. But captured data  have 802.1q tag, also port 21 was setted access port. What should I do to remove 802.1q tag ?

[pc]------[Procurve]port21 vlan100----------vlan100[hoge]-----[pc]
                        | port1
               [Capture PC]
2 Solutions
Do you have a VLAN aware NIC on the PC capturing the data?  Use a .1q compliant NIC if you what to see all bidirectional traffic on a ProCurve mirror port. If you dont have a .1q compliant NIC, make sure to enable the .1p setting in the driver, this will allow it to receive the oversized packet (although it wont interpret the VLAN tag).
-Generally- speaking, traffic out an untagged port will
usually show up untagged on the mirroring port, and traffic out
a tagged port will usually show up tagged on the mirroring
port, unless the primary vlan ID of the port happens to match the
VLAN ID of the packet, in which case 802.1Q says the tag should
be stripped.  
Kamran ArshadCommented:

You can check if your NIC is 802.1q compatible. Follow the steps;

1- Go to 'Device Manager'
2- Right Click on your NIC 'Properties'
3- Go to the 'Advanced' tab.

Here you will see if your NIC is compatible with 802.1q or not. If not then try updating the NIC driver.

Featured Post

Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now