My Sniffer Isn't Seeing VLAN, 802.1q, or QoS Tagged Frames

Documentation

Maintenance & Performance

000005498

02/01/2020

What am I seeing?

My sniffer is not seeing VLAN or QoS tagged frames.

How do I fix it?

Note
  • After changing the adapter registry setting in Windows*, you must restart Windows for the new registry setting to work.
  • The tagging frames get stripped out by the driver; however, making a registry change can be done in order to see the tags. In some drivers, the registry change does not allow the type of tags to be passed. Most of the drivers have this feature now. We recommend using the latest driver version available.

 

  • In Windows*

    To allow tagged frames to pass to your packet capture software, add a registry dword and value, or change the value of the registry key. The driver used impacts the registry change required:

     
    Adapter Driver Registry Key
    e1g, e1e, e1y MonitorModeEnabled
    e1c, e1d, e1k, e1q, e1r, ixe, ixn, ixt MonitorMode
    Note

    Place the new key (dword) at:

    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\00nn

    Where nn is the physical instance of the network port where you want to capture the VLAN tags. ControlSet001 might need to be Current Control Set or another 00x number.

     
    Caution
    		 Changes to the registry can disable your system. Have a skilled technician make the changes to the registry. This change is only for promiscuous mode/sniffing use.

    When creating or changing registry dword MonitorModeEnabled, set the dword value to one of the following:

    • 0—disabled (Do not store bad packets, Do not store CRCs, Strip 802.1Q vlan tags)
    • 1—enabled (Store bad packets. Store CRCs. Do not strip 802.1Q vlan tags)

    When creating or modifying registry dword MonitorMode, set the dword value to one of the following options:

    • 0—disabled (Do not store bad packets, Do not store CRCs, Strip 802.1Q vlan tags)
    • 1—enabled (Receive bad/runt/invalid CRC packets. Leave CRCs attached to the packets. Do not strip VLAN tags and ignore packets sent to other VLANs as per normal operation.)
    Note You must restart Windows for the registry change to take effect.
     
  • In Linux*

    By default, the driver in promiscuous mode does not strip VLAN tags.

    To strip VLAN tags: Load the kernel supplied 802.1q module. This step automatically enables the Intel Networking hardware offload capabilities to offload VLAN tag stripping and insertion. For support and information on loading the 802.1q module, contact your distribution.

    Your capture software is responsible for enabling promiscuous mode in your driver. If the driver is not in promiscuous mode, the packets are dropped or ignored because of the bad type/len field.

Related topics
Latest Drivers and Intel® PROSet/Wireless Software Available on Download Center
Intel® Driver & Support Assistant