TCPDUMP Tricks — Find a Port’s Configured Vlan and Port Number

Green_toys_dump_truckSo this was a new one to me. I never knew that you could get a network ports vlan configuration using Tcpdump.  In the past I've used cdpr to determine an interface's uplink port, but I never knew that you could use tcpdump to get the same information and also determine the VLAN.

Note that I did not discover this one myself. So if you happen to be the person who told me how to do this, thanks and pipe down.

Anyway here is the command, note that my interface is em1, your's will probably be different.

tcpdump -nn -vvv -i em1 -s 1500 -c 1 'ether[20:2] == 0x2000'

From the command above you get a nice little bit of output, which you have to poke through a bit to get the meaty parts out. Hey look its my port, and the name and ip of the switch upstream.

Device-ID (0x01), length: 27 bytes: ''                   
Address (0x02), length: 13 bytes: IPv4 (1)                           
Port-ID (0x03), length: 16 bytes: 'FastEthernet3/28'

Now check out this sweet nugget. A VLAN!

Native VLAN ID (0x0a), length: 2 bytes: 246


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.