Monitoring tagged traffic is not a straightforward mission. The issues of whether you see VLAN tags while capturing data with Wireshark or not will depend on the network adapter you have, the driver that runs over it, and what they do with VLAN tags.
The simplest way to verify that your laptop can capture tagged frames is as follows:
- Start capturing the tagged port with the port mirror. If you see tags, continue with your work.
- If you don't see any tags, go to the adapter configuration. In Windows 7, you get there by clicking on Start and then navigating to Control Panel | Network and Internet | View Network Status and Tasks | Change Adapter Settings | Local Area Connection. Next, perform the steps as shown in the following screenshot:
Figure 8.15: Enabling priority and VLAN
Configure the adapter with priority and VLAN disabled. This will move the tags for the WinPcap driver and for the Wireshark
In the previous screenshot, we see an example of a Lenovo laptop with Realtek NIC. The illustration gives an example on a popular device, but it can be different on other laptops or servers. The principle should be the same: disable the adapter by extracting the VLAN tag so that it will be forwarded to the WinPcap driver and presented on Wireshark.