Tyler West <[EMAIL PROTECTED]> writes: > 20:43:54.919506 00:08:7c:d3:76:c2 > 00:08:02:8d:39:80, ethertype 802.1Q > (0x8100), length 169: vlan 11, p 0, ethertype IPv4, IP 172.19.16.69 > > 150.4.1.70: icmp 131: echo request seq 42883
> The one thing that stood out to me is that the Cisco switch is > including the 802.1q information in the Ethernet header when it is > mirroring. Indeed that is the problem. For some reason, recent libpcap versions do not match on tagged packets anymore. This is Debian bug #267765: <URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=267765> I guess your setup will work fine if you convince the Cisco switch to untag traffic before sending it to the Debian box. Unfortunately, I don't have convenient access to any VLAN-capable hardware so I cannot debug this properly at the moment. Sorry. Thanks for all the information you provided! -- ,''`. : :' : Romain Francoise <[EMAIL PROTECTED]> `. `' http://people.debian.org/~rfrancoise/ `- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
