> On Wed, Mar 23, 2005 at 01:38:28PM -0500, cnelson@xxxxxxxxxxxx wrote: > > Can I open a raw socket and get all traffic on an interface with > > VLAN tags intact? Anything to get me started would be welcome. > > Use eth0. Are you saying that if I open eth0, I'll see everything but if I open eth0.xx I'll only see traffic for VLAN xx? I've tinkered with this a little and what I seem to find is that if my switch sends tagged frames to the Linux system, system services (arp, etc.) don't work. I'm guessing that they don't know what to do with tagged frames and that he frames aren't stripped. > You could also check out libpcap which may be able to do > most of the work for you. Processing tags myself is trivial -- it's just a 4-bytes offset in the Ethernet frame. The problem I'm having is getting system services to ignore (or not see) tags.
