Ethereal-dev: Re: [Ethereal-dev] v0.9.9 through v0.10.7 can't recognize Cisco ISLframes

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Jim Young" <sysjhy@xxxxxxxxxxxxxxx>
Date: Wed, 03 Nov 2004 15:11:05 -0500
Hello Ian,

Please feel free to share the attached trace file 
"isl-dot1q.gz" (along with the related readme) 
on the wiki.  About halfway through the trace you 
will see the trunk interface has been reconfigured 
from ISL to 802.1Q.

In the future I hope to provide other more useful 
trunking examples.

Best regards,

Jim Young 

>>> ethereal@xxxxxxxxxxxxx 11/03/04 12:29PM >>>
> Hi Jim,
> 
> Do you have an example (binary) trace with ISL-tagged frames that
you'd  
> be willing to submit?  I'd like to put one in the example files Wiki.
  
> Presumably it'd be something that you don't mind potentially sharing 

> with the entire world.
> 
> Naturally, the more diverse the examples in the trace, the better...
> 
> Thanks,
> Ian Schorr

Attachment: isl-2-dot1q.cap.gz
Description: GNU Zip compressed data

2004-11-03: notes on capture file isl-2-dot1q.gz

The trace file "isl-2-dot1q.gz" contains in total
745 frames spanning an elapsed time of just over 140 
seconds. 

This data was captured from a port configured as a 
"trunk" interface on a Cisco c3524xl switch.  "Trunk" 
interfaces are used to multiplex multiple vlans accross 
one physical interface.  This "trunk" was configured to 
support the following 10 vlans:

   vlan 1 (0x0001) The default/native/management vlan
   vlan 111 (0x006f) 
   vlan 222 (0x00de) 
   vlan 333 (0x014d) 
   vlan 444 (0x01bc) 
   vlan 555 (0x022b) 
   vlan 666 (0x029a)
   vlan 777 (0x0309) 
   vlan 888 (0x0378) 
   vlan 999 (0x03e7)  

Frames 1 through 381 represent vlan traffic encapsulated 
using Cisco's propritary InterSwitch Link (ISL) trunking
method.  

Frames 382 through 745 show the traffic sent by the switch 
after the trunk had been reconfigured to support 802.1Q 
trunking instead of the default ISL default encapsultion.
The IOS command "switchport trunk encapsulation dot1q"
was entered on the apprropriate trunk interface.

Several interesting things to note...

Spanning Tree Protocol (stp) packets are sent every two 
seconds on each of the defined vlans resulting in bursts
of ten stp packets every 2 seconds.  

CDP packets (unless disabled) are sent every sixty seconds 
on the default vlan (Vlan 1 in this case).  CDP packet 
encapsulted in ISL is at frame 251.  CPD packet seen on 
802.1Q trunk is at frame 569.

When ISL is enabled it appears that ALL traffic sent 
by the switch on this trunk will be encapsulated including 
traffic on the default vlan (vlan 1).

When 802.1Q is enabled, only the non-default vlan data
is "encapsulated" with the 802.1Q header.  The default 
vlan (Vlan 1 in this case) does NOT have any special header.

[eof:jhy]