Earlier today I was needing to verify two pieces of configured equipment were using the correct 802.q trunks by using a packet capture. I tried using an old 3550xl switch in our lab but it was stripping the vlan tags and only mirroring the native port. After that, I grabbed a 4948 that we were setting up for a customer to test with. It also, was stripping the tags. I verified with with a laptop and Linux server. I then found I was able to preserve the tags by adding encapsulation dot1q to the destination port as shown below.
monitor session 1 source interface Gi1/1
monitor session 1 destination interface Gi1/2 encapsulation dot1q
After doing this the laptop was still not showing the tags, but the server was. Note when checking 802.1q tags your Ethernet interface and or operating system may not report correctly, so if you don’t see what you are expecting try testing with a different system.
Brian Christopher Raaen…. Formerly The Cisco Kid
Brian, please note the following:
On Windows, it is a feature of the network driver.
On Linux, capturing tagged VLANs are built into the modern kernels.
Take a look into the following Wireshark information, might be quite old.
https://wiki.wireshark.org/CaptureSetup/VLAN