Networking Connectivity
Network Connectivity
My sniffer is not seeing VLAN, 802.1q, or QoS tagged frames

Symptom(s):

My sniffer is not seeing VLAN or QoS tagged frames.

Solution:

Note

After changing the adapter registry setting in Windows, you must restart Windows for the new registry setting to work.

For Microsoft Windows*

To allow tagged frames to be passed to your packet capture software, add a registry dword and value, or change the value of the registry key. The driver used impacts the registry change required:

Adapter Driver

Registry Key
e1g, e1e, e1y MonitorModeEnabled
e1c, e1d, e1k, e1q, e1r, ixe, ixn, ixt MonitorMode

Notes

To understand which driver to use, see how do I identify my wired Ethernet adapter and driver version?

Drivers included in Microsoft Windows might not include support for promiscuous mode. This registry entry is only supported on Intel drivers.

The new key (dword) should be placed at:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\00nn

Where nn is the physical instance of the network port where you want to capture the VLAN tags.

Note ControlSet001 might need to be Current Control Set or another 00x number.


Caution
Changes to the registry can disable your system. Have a skilled technician make the changes to the registry. This change is only for promiscuous mode/sniffing use.

When creating or changing registry dword MonitorModeEnabled, set the dword value to one of the following:

  • 0 - disabled (Do not store bad packets, Do not store CRCs, Strip 802.1Q vlan tags)
  • 1 - enabled (Store bad packets. Store CRCs. Do not strip 802.1Q vlan tags)

When creating or modifying registry dword MonitorMode, set the dword value to one of the following options:

  • 0 - disabled (Do not store bad packets, Do not store CRCs, Strip 802.1Q vlan tags)
  • 1 - enabled (Receive bad/runt/invalid CRC packets. Leave CRCs attached to the packets. Do not strip VLAN tags and ignore packets sent to other VLANs as per normal operation.)
Note You must restart Windows for the registry change to take effect.

For Linux*

By default, the driver in promiscuous mode does not strip VLAN tags.

To strip VLAN tags: Load the kernel supplied 802.1q module. This step automatically enables the Intel Networking hardware offload capabilities to offload VLAN tag stripping and insertion. For information on loading the 802.1q module, contact your distribution for support.

Your capture software is responsible for enabling promiscuous mode in your driver. If the driver is not in promiscuous mode, the packets are dropped or ignored because of the bad type/len field.

This applies to:

Intel® Ethernet Converged Network Adapter X520 Series
Intel® Ethernet Converged Network Adapter X540-T1
Intel® Ethernet Converged Network Adapter X540-T2
Intel® Ethernet Converged Network Adapter X710 Series
Intel® Ethernet Converged Network Adapter XL710 Series
Intel® Ethernet Server Adapter I210-T1
Intel® Ethernet Server Adapter I340-F4
Intel® Ethernet Server Adapter I340-T4
Intel® Ethernet Server Adapter I350-F2
Intel® Ethernet Server Adapter I350-F4
Intel® Ethernet Server Adapter I350-T2
Intel® Ethernet Server Adapter I350-T4
Intel® Gigabit CT Desktop Adapter
Intel® Gigabit EF Dual Port Server Adapter
Intel® Gigabit ET Dual Port Server Adapter
Intel® Gigabit ET Quad Port Server Adapter
Intel® Gigabit ET2 Quad Port Server Adapter
Intel® PRO/100 M Desktop Adapter
Intel® PRO/100 S Desktop Adapter
Intel® PRO/100 S Dual Port Server Adapter
Intel® PRO/100 S Server Adapter
Intel® PRO/100 VE Desktop Adapter
Intel® PRO/1000 GT Desktop Adapter
Intel® PRO/1000 GT Quad Port Server Adapter
Intel® PRO/1000 MF Dual Port Server Adapter
Intel® PRO/1000 MF Server Adapter
Intel® PRO/1000 MF Server Adapter (LX)
Intel® PRO/1000 MT Desktop Adapter
Intel® PRO/1000 MT Dual Port Server Adapter
Intel® PRO/1000 MT Quad Port Server Adapter
Intel® PRO/1000 MT Server Adapter
Intel® PRO/1000 PF Dual Port Server Adapter
Intel® PRO/1000 PF Quad Port Server Adapter
Intel® PRO/1000 PF Server Adapter
Intel® PRO/1000 PT Desktop Adapter
Intel® PRO/1000 PT Dual Port Server Adapter
Intel® PRO/1000 PT Quad Port Low Profile Server Adapter
Intel® PRO/1000 XF Server Adapter
Intel® PRO/1000 XT Low Profile Server Adapter
Intel® PRO/1000 XT Server Adapter

Solution ID: CS-005897
Last Modified: 03-Sep-2014
Date Created: 10-Feb-2003
Back to Top