Mirror VLAN Tag Not Stripped

[NOYB2NOYB]

Model: SG200-08

Config:

Port 1 - 5 VLAN 1 UnTagged Member, VPID 1 (defult config)

Port 6 - VLAN 99 Tagged Member, VLAN 1 Untagged Member, VPID 1 (default)

Port 7 - VLAN 99 UnTagged Member, VPID 99

Port 8 - VLAN 99 UnTagged Member, VPID 99

Port 8 Tx & RX Mirrored to Port 4

VLAN 99 packets transmitted out port 8 with vlan tag stripped, as it should be, and are mirrored to port 4 except the vlan tag is not stripped.

What needs to be configured for the mirrored packets to be same as what is actually going out on the wire (vlan tag stripped)?

Thanks.

[Tom Watts]

Port 8 should not have a vlan membership and therefore cannot have a tagged packet except what is coming from port 4. You cannot create a SPAN while the port is a member of any vlan but the default which is untagged.

-Tom
Please mark answered for helpful posts

[NOYB2NOYB]

What?

There is nothing coming from port 4.  Port 4 is the destination of the mirror with network analyzer attached.  Traffic of port 8 is mirrored TO port 4 to be probed by the network analyzer.

Why should port 8 not have a VLAN membership?  Doesn't it have too in order to participate in the VLAN 99? How else would packets get from ports 6 & 7 to port 8 if it is not a member of VLAN 99?

[Tom Watts]

It is my misinterpretation. I read it as port 4 is the port you are monitoring.

You should still see vlan 99 advertisement even if it is an untagged member.

-Tom
Please mark answered for helpful posts

[NOYB2NOYB]

But what I want to see is what is actually being put out on the wire.  Which is untagged.  Otherwise it is indicating that tagged packtes are being sent out and is missleading.

[Tom Watts]

That is untrue and impossible. The reason is, 802.1q will always include the vlan id unless it is a member of the default vlan. Vlan 99 although untagged is NOT the default vlan.

-Tom
Please mark answered for helpful posts

[NOYB2NOYB]

Don't think that is correct.  The point of the port being an untagged member of a VLAN is so that the VLAN tag gets stripped from packets going out onto the wire.  Which it is.  Verified by hanging a true HUB off of port 8 with a network analyzer.  There is no VLAN tag present.  But yet the VLAN is still present on the probe port.

[Tom Watts]

Okay, please explain this scenario-

Router is 192.168.100.1.

Switch is 192.168.100.2

Host A is 192.168.100.3

Host B is 192.168.100.4

Host A is a member of vlan 1 untagged

Host B is a member of vlan 2 untagged

Both host A and B are in the same subnet and share the same default gateway but are in the different vlans.

Does Host A and Host B communicate to each other?

-Tom
Please mark answered for helpful posts

[NOYB2NOYB]

No. Because the switch does not forward vlan 1 packets to vlan 2 member ports nor vlan 2 packets to vlan 1 member ports.
Not because the packets are tagged or untagged upon egress.
If the switch ports host A and B are conected to are untagged members of their respective VLAN (1 & 2) then the packets will be untagged up on egress.  And if you run a sniffer on them you won't see the vlan tags.

Assuming 802.1q (General mode), not Trunked or Access.

[Tom Watts]

What are the size of the packets you see when comparing to a hub vs the SPAN?

-Tom
Please mark answered for helpful posts

[NOYB2NOYB]

4 bytes less.  The size of VLAN tags.  Amazing coincidence eh.

[Tom Watts]

I am having a fun conversation on the side and here is how I justify what you're seeing. This is exactly a snippit of our IM conversation-

NAME REMOVED

for untagged pkt12:04 am

tag pkt has vlan info

sw1 port1 (native vlan =1) ---untagged pkt--------port2 (native vlan=2) sw 2 , then the pkt will be placed in vlan 2 in sw 212:06 am

i think in the thread he configure port8 to use v99 as pvid, and expect pkt in vlan 99 to be untagged out of the port812:07 am

do u think that's true or false

port8 in access mode with vlan 99 as acess vlan , i guess12:09 am

do u think so?

and port 4 as mirror port for port 8 as source port

the guy wants to see untagged pkt out of mirror port 4 but he saw tagged pkt

Tom Watts:

which is correct12:10 am

I will explain

If  vlan 99 is not configured as the native vlan on another 802.1q port,  that port will send tag from on vlan 99. when the local port, which is  vlan 2 is onreceipt, the distant port will either associate untag frame  with the different vlan id (locally configure as the native vlan) or  will discard the untag frame since it has no native vlan configured.  Hence, in a symmetric manner the remote port will send only untag frame  on its configured native vlan which will be associated to a different  vlan id by the local port12:12 am

NAME REMOVED

If vlan 99 is not configured as the native vlan on another 802.1q port,  which port is "the another 802.1 q port"?12:15 am

port6?

Tom Watts:

we'd have to assume 412:17 am

but it shouldnt be

since it is neutral

NAME REMOVED

you mean mirror port 4 vlan configuration has impact to the pkt format?12:17 am

Tom Watts:

if what he says is true then yes

-Tom
Please mark answered for helpful posts

[NOYB2NOYB]

No.  Port 4 mirror target does not have impact on what is going out on port 8 wire.  Think you are still misunderstanding.  Don't make is so complex.  It is a very simple setup.

Port 8 is an untagged member of vlan 99 with a PVID of 99 and in "general mode" (802.1q).  Not trunk nor access mode. And is not a member of any other vlans.

Port 8 is source port of mirror to destination on port 4.

Traffic egress form port 8 onto the wire has no vlan tag.  That is as expected.

However, the traffic being analyzed from the mirror destination port 4 does have the vlan 99 tag.  But I don't what it to because that then does not reflect what actually went out on the wire connected to port 8.

[Tom Watts]

I know. Thats what the conversation is about. Why would a neutral monitor port have a vlan id affixed? The only explanation is that the port 4 is following rules of 802.1q while it shouldn't.

-Tom
Please mark answered for helpful posts

[NOYB2NOYB]

The neutral monitor port should have the same vlan id affixed as the source port on wire traffic.  So in the case of a tagged vlan it would be expected to vlan id affixed to the packets.  But in this case the monitor source port is an untagged member and therefor the packets should not have a vlain id affixed.