How to capture 802.1Q tags on a Broadcom NIC

Wow, this has truly been an adventure.  I’ve been trying for the better part of a month to get WireShark to capture 802.1q tags.  I’ve been through it all.  Different NICs, different drivers, and endless googling.  Today, I have finally made a breakthrough.  After trying 2 different Realtek NICs and a Intel 1000MT I tried a Broadcom NetXtreme card and with a few changes, I was able to get it to work…

image

Here’s what I did to finally make it work.

Added a string value under…

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0020

The new value was called…

PreserveVlanInfoInRxPacket

and I set it to a value of 1. 

I also removed most of the network services from the NIC…

image 
image

After that, I did a reboot and I started seeing the tags. 

Leave a Reply

Your email address will not be published.