Packet Captures
STP-TCN-TCAck.pcapng.cap 692 bytes
Submitted Mar 11, 2016 by sahil_pujani
Spanning Tree 8021.D Topology Change Notification and Topology Change Ack.
Packet 4: aa:bb:cc:00:02:00 generates TCN because of Link failure Packet 5: aa:bb:cc:00:01:00 is the Root Bridge and it generates TCAck.
| Packets: 5 | Duration: 5s | Downloads: 8432 |
Spanning Tree - MST.pcapng.cap 3.4 KB
Submitted Apr 22, 2015 by JozefHamar
Example of Multiple Spanning Tree with IEEE 802.3 + 802.2 LLC without SNAP encapsulation.
| Packets: 19 | Duration: 36s | Downloads: 9332 |
MSTP_Intra-Region_BPDUs.cap 1.7 KB
Submitted May 1, 2012 by lobo
MSTP BPDUs captured on an intra-region root port.
00:1f:27:b4:7d:80 - CIST Root (is in another MSTP Region)
00:16:46:b5:8c:80 - CIST Regional Root, Root for Instance 0, 2
00:1e:f7:05:a8:80 - Root for Instance 1
Notice in frame 1 that 00:1e:f7:05:a8:80 uses 32768.00:16:46:b5:8c:80 (Regional Root BID) as bridge ID in the main STP header to make the region appear as a single bridge.
| Packets: 10 | Duration: 10s | Downloads: 12865 |
packet-c.cap 675.0 KB
Submitted Jan 31, 2012 by Slaingod
This is a packet capture from a SonicWall. We were troubleshooting DHCP packet flows. The SonicWall saw the DHCP Discover and Sent an Offer. We never saw the DHCP acknowledgement. In the adjacent core stacked switching we were running "debug ip dhcp server packets" we only saw discover packets from IP phones up to the SonicWall. For some reason the SonicWall could not let any other DHCP packets through or out of it INSIDE (LAN) interface. Even if we put an ANY-ANY ALC for that interface. We ended up having to replace the SonicWall and upload the configuration from the old SonicWall to the new one.
-Slaingod
BOOTP DNS HTTP IP LLC SKINNY SSL STP TCP UDP
| Packets: 926 | Duration: 13s | Downloads: 15586 |
rpvstp-trunk-native-vid5.pcap.cap 1.8 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 5, VLAN 1 is also active over the trunk.
Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN 5 (not tagged - Frame 5) and one for each other active VLAN (tagged - Frame 3).
The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).
DTP Ethernet LLC LOOP STP VLAN VTP
| Packets: 22 | Duration: 11s | Downloads: 13633 |
rpvstp-trunk-native-vid1.pcap.cap 6.4 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 1 (default), VLAN 5 is also active over the trunk.
Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN (not tagged - Frame 3) and one for each other active VLAN (tagged - Frame 5).
The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).
DTP Ethernet LLC LOOP STP VLAN VTP
| Packets: 81 | Duration: 45s | Downloads: 11897 |
rpvstp-access.pcap.cap 3.7 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of an access port (without portfast), configured in VLAN 5.
DNS Ethernet IP LLC LOOP STP UDP
| Packets: 49 | Duration: 77s | Downloads: 9165 |
802.1w_rapid_STP.cap 2.2 KB
Submitted Sep 14, 2009
Rapid Spanning Tree Protocol BPDUs are received from a Catalyst switch after connecting to a port not configured for PortFast. The port transitions through the blocking and learning states before issuing a topology change notification (packet #30) and transitioning to the forwarding state.
| Packets: 30 | Duration: 56s | Downloads: 11492 |