如何让Intel Pro100网卡在wireshark中支持VLAN-ID抓取

Posted 2023-03-20

参考技术A Intel PRO/1000 or PRO/100 Ethernet controller which are used in e.g. IBM Notebooks (T40 series and others) do not forward VLAN tags to the upper layers; By default, Intel adapters strip the VLAN tag before passing it up the stack. If you need to see the tag you need to use these driver versions: PRO/100 6.x or 7.x or later base driver, PRO/1000 7.2.17.803 (plain 7.2.17 does not have this feature).
To enable, you must go into the registry and either add a registry dword and value (for e100) or change the value of the registry key (for e1000). The registry dword is MonitorModeEnabled (for both). It should be placed at HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class4D36E972-E325-11CE-BFC1-08002BE10318\00xx where xx is the instance of the network adapter that you need to see tags on. (Check by opening and viewing the name of the adapter). It should be set to read: MonitorModeEnabled= 1. Note: ControlSet001 may need to be CurrentControlSet or another 00x number
For Broadcom 570x Gigabit adapters (for example in Dell systems); Add a registry key underHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet to cause the driver not to strip the 802.1Q VLAN header. In order to set that key, you need to find the right instance of the driver in Registry Editor and set that key for it.
Run the Registry Editor (regedt32).
Search for “TxCoalescingTicks” under"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet" and ensure this is the only instance that you have.
Right-click on the instance number (eg. 0008) and add a new string value.
Enter “PreserveVlanInfoInRxPacket” and give it the value “1″.
Save and Reboot
You may need to install a recent driver (version 8.27) to make this setting effective本回答被提问者和网友采纳