TCPDUMP Tricks — Find a Port’s Configured Vlan and Port Number

Green_toys_dump_truckSo this was a new one to me. I never knew that you could get a network ports vlan configuration using Tcpdump.  In the past I've used cdpr to determine an interface's uplink port, but I never knew that you could use tcpdump to get the same information and also determine the VLAN.

Note that I did not discover this one myself. So if you happen to be the person who told me how to do this, thanks and pipe down.

Anyway here is the command, note that my interface is em1, your's will probably be different.

tcpdump -nn -vvv -i em1 -s 1500 -c 1 'ether[20:2] == 0x2000'

From the command above you get a nice little bit of output, which you have to poke through a bit to get the meaty parts out. Hey look its my port, and the name and ip of the switch upstream.

Device-ID (0x01), length: 27 bytes: 'SW2.corp.example.com.'                   
Address (0x02), length: 13 bytes: IPv4 (1) 172.22.10.254                           
Port-ID (0x03), length: 16 bytes: 'FastEthernet3/28'

Now check out this sweet nugget. A VLAN!

Native VLAN ID (0x0a), length: 2 bytes: 246

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s