Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to experiment with a vlan interface on my desktop ubuntu machine. The desktop has only one single interface (eth0) connected to the company LAN. After using vconfig to create the vlan interface, running wireshark on the interface does not show outgoing packets as vlan tagged. Here is what I did:

$ ifconfig
eth0      Link encap:Ethernet  HWaddr 84:2b:2b:87:2c:87  
          inet addr:192.168.0.126  Bcast:192.168.0.255  Mask:255.255.255.0
          etc...

Then I add the vlan interface:

$ sudo vconfig add eth0 55
$ sudo ifconfig eth0.55 192.168.10.100 netmask 255.255.255.0 up
$ sudo ifconfig eth0.55 mtu 1412
$ ifconfig -a

eth0      Link encap:Ethernet  HWaddr 84:2b:2b:87:2c:87  
          inet addr:192.168.0.126  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::862b:2bff:fe87:2c87/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:12195 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7435 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6831057 (6.8 MB)  TX bytes:1138706 (1.1 MB)
          Interrupt:18 

eth0.55   Link encap:Ethernet  HWaddr 84:2b:2b:87:2c:87  
          inet addr:192.168.10.100  Bcast:192.168.10.255  Mask:255.255.255.0
          inet6 addr: fe80::862b:2bff:fe87:2c87/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1412  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:168 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:23515 (23.5 KB)

So far so good .. Here's the additional related information:

$ sudo cat /proc/net/vlan/eth0.55
eth0.55  VID: 55     REORDER_HDR: 1  dev->priv_flags: 1
         total frames received            0
          total bytes received            0
      Broadcast/Multicast Rcvd            0

      total frames transmitted          170
       total bytes transmitted        23697
Device: eth0
INGRESS priority mappings: 0:0  1:0  2:0  3:0  4:0  5:0  6:0 7:0
 EGRESS priority mappings: 



$ sudo iptables -L -v
Chain INPUT (policy ACCEPT 3317 packets, 2230K bytes)
 pkts bytes target     prot opt in     out     source     destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source     destination         

Chain OUTPUT (policy ACCEPT 1528 packets, 189K bytes)
 pkts bytes target     prot opt in     out     source     destination         




$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     1      0        0 eth0
192.168.10.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0.55

Now I try to ping some non-existent machine in the 192.168.10.xx range:

$ ping -I eth0.55 192.168.10.101

However, when capturing this interface with wireshark or tcpdump, I see normal arp messages being sent out. They are NOT vlan tagged. (My interest here is to first see if I can get vlan packets out of my machine .. working with actual vlans will come later). I am also able to ping the eth0.55 interface from a vbox VM on same machine.

$ sudo /usr/sbin/tcpdump -vv -i eth0.55
tcpdump: listening on eth0.55, link-type EN10MB (Ethernet), capture size 65535 bytes
11:55:52.625984 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.10.101 tell 192.168.10.100, length 28
11:55:53.625983 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.10.101 tell 192.168.10.100, length 28

I even tried set_flag command, but still a no-go:

$ sudo vconfig set_flag eth0.55 0

What am I missing?

share|improve this question
    
I can confirm that the first two replies are correct. I too had this issue, but then on these suggestions tried capturing the physical interface instead of the vconfig interface and can confirm that the physical interface does show you the vlan tagged packets. I created an account to up vote the above replies, but apparently I need reputation before I can do that... –  user172255 May 3 '13 at 10:20
add comment

3 Answers

Here's a similar question: VLAN tags not shown in packet capture (Linux) via tcpdump

Actually what you seen are packets filtered by kernel when using tcpdump, where the vlan layer is removed so it always looks like untagged.

You already saw there're transferred frames via /proc/net/vlan/eth0.55 so it works very well.

According to your case, use this command to see the VLAN tag:

tcpdump -Uw - | tcpdump -i eth0 -en -r - vlan 55
share|improve this answer
add comment

To see the actual 802.1q tags, try capturing on the underlying physical interface, i.e. eth0, which is where packets are going in/out.

share|improve this answer
add comment

Probably you not miss anything.
When you not have vlan on interface then you can see 802.1q tags with tcpdump.
When you add vlan to the interface then 8021q module enable hardware acceleration and... you stop to see tags. You will see separated traffic on subinterfaces but tcpdump on main interface show trafic from all subinterfaces with stripped tags.
If you have modern ethtool then you can look at ethtool -k eth0 output and you can try to disable acceleration with ethtool -K eth0 rxvlan off; ethtool -K eth0 txvlan off; (to be honest - I never test if it help to see tags and not have access to good lab host right now for check).
But I think you should just configure rest of your infrastructure and try to see if it working as expected (of see tagged arp requests on another machine with 8021q module not loaded).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.