How to mirror packets along with the dot1q tag to Windows PC

By esupport posted Jun 03, 2020 02:41 PM

  
Requirement:

 

When a port on the switch with tagged VLAN is mirrored to a Windows PC the dot1q header may not be displayed in Wireshark.

Only some ethernet NIC/driver will allow to capture dot1q header directly on Windows. In some cases changes need to be made to the registry to enable display of VLAN tagging.

Here is a technique that can be used to capture the dot1q header on Windows PC without any registry changes.

A Windows PC with Wireshark and IP connectivity to the switch is required for this task.

 



Solution:

 

ArubaOS-Switch supports remote mirroring feature which can be used in this scenario. The switch will send the mirrored packets along with a GRE encapsulation to the destination PC.

The source IP (an interface on the switch) and the IP address of the remote PC (which has Wireshark running) needs to be specified along with a UDP port number.

This UDP port number will later be used in Wireshark to Decode the packet.

 



Configuration:

 

  • Below is the configuration that is required on the switch to enable remote mirroring.
mirror <id> remote ip <Source VLAN Interface IP on the switch> <UDP port number for encapsulation> <IP address of the PC running Wireshark>
interface <id> all both mirror <id>

 

Sample configuration to enable mirror on interface 1

Aruba-3810M-40G-8SR-PoEP-1-slot# configure terminal
Aruba-3810M-40G-8SR-PoEP-1-slot(config)# mirror 2 remote ip 10.0.0.1 5454 10.0.0.10
The destination switch must be configured before proceeding.

Has the remote switch been configured (y/n)? y
Aruba-3810M-40G-8SR-PoEP-1-slot(config)#

Aruba-3810M-40G-8SR-PoEP-1-slot(config)# interface 1
Aruba-3810M-40G-8SR-PoEP-1-slot(eth-1)# monitor all both mirror 2
Aruba-3810M-40G-8SR-PoEP-1-slot(eth-1)# end
Aruba-3810M-40G-8SR-PoEP-1-slot#

Aruba-3810M-40G-8SR-PoEP-1-slot# sho monitor 2
Network Monitoring

   Session: 2    Session Name:
      Mirror Destination:  IPv4
         UDP Source Addr  UDP port  UDP Dest Addr    Status
         ---------------  --------  ---------------  --------
         10.0.0.1         5454      10.0.0.10        active

      Monitoring Sources  Direction Truncation Mirror Policy
      ------------------  --------- ---------- -------------
      Port: 1             Both       No         -

 

  • In the Windows PC.

Open Wireshark and start capture for the interface corresponding to the destination IP on the switch

UDP packets with destination port 5454 can be seen, as displayed in the screenshot below

 

Right click on the UDP packet and click on 'Decode As...'

Select 'HP_ERM' from the dropdown in 'Current' field. Please refer below screenshot.

 



Verification

 

After the packets are decoded, Wireshark will decode and display the packets

 

Below is the screenshot of a packet sent by the switch with dot1q header information. The monitored interface on the switch is configured to tag packets for VLAN100.

 

0 comments
0 views