1

I have a Nortel switch (4524GT-PWR) which does something strange on the mirror port.

Configuration screenshot: Port Mirror

All frames that are sent to the the mirror port are tagged with VLAN 1. All frames that originate to the mirrored port do not have a VLAN tag.

To clarify this further, the PC that is connected to the mirror port is receiving frames with VLAN tags on half the packets. The original port that the traffic is mirrored from is not using VLAN tags.

ntopng does not like this, resulting in mixed up statistics.

I have found no option in the switch to deactivate this "feature".

Is it possible to remove the VLAN tag from the frame with iptables or something else before it reaches ntopng?

The device to capture the traffic from the monitoring port is a Realtek R8152 USB 3.0 device.

2 Answers 2

1

Found out that is a problem with the Switch and can't be solved in software.

"Solved" the issue I was having with ntop by changing the ntopng sources to always set the vlan_id to 0.

0

From what I can tell your best course of action would be to strip the VLAN tags at the switch and not try to do all of this processing in Linux. You might be able to craft something from tcpdump and libpcap that would capture all traffic and process it but from what I can tell this doesn't exist and you would have to write it.

Run show vlan int info to see what your tagging options on each port are.

If it is set to TagAll you should change the mirror port to tagging untagall

3
  • There are no trunks configured on the switch. The intention is to mirror traffic from one port to another one. I don't have any benefit from VLAN tags in this case. I know the NIC understands VLAN tags (or believe so), because those tags show up in Wireshark when I capture traffic. It's an Realtek R8152 USB 3.0 device. Jun 19, 2017 at 22:22
  • Correct. There is no need for VLAN in my setup. So VLANs are not configured. I don't need the VLAN tag in my frames. Default VLAN is VLAN1 which is always configured, although the tag should not be added to the frame... Jun 20, 2017 at 7:14
  • Thanks. It is set to UntagAll Port Frames Frames PVID PRI Tagging Name 19 No Yes 1 0 UntagAll Port 19 Jun 20, 2017 at 22:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .