Hello,
I’m using packet sniffer on a CCR1072, running ROS version 6.37.4.
The following image of the ‘Packets’ window in winbox shows traffic incoming (rx) to CCR inteface ether1 in VLAN id 99:
Based on my network configuration this is completely strange, those packets should not have a VLAN id (it is traffic on untagged VLAN).
Indeed, if I use the terminal command /tool sniffer packet it displays no vlan field:
/tool sniffer packet> print detail
0 time=0.468 num=1 direction=rx src-mac=00:21:D8:XX:XX:XX dst-mac=4C:5E:0C:XX:XX:XX interface=ether1 src-address=x.x.x.73:50594 dst-address=10.0.254.200:8291 (winbox)
protocol=ip ip-protocol=tcp size=60 cpu=14 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=29529 fragment-offset=0 ttl=127 tcp-flags=ack
1 time=0.704 num=2 direction=rx src-mac=00:21:D8:XX:XX:XX dst-mac=4C:5E:0C:XX:XX:XX interface=ether1 src-address=x.x.x.73:50594 dst-address=10.0.254.200:8291 (winbox)
protocol=ip ip-protocol=tcp size=116 cpu=14 fp=no ip-packet-size=102 ip-header-size=20 dscp=0 identification=29636 fragment-offset=0 ttl=127 tcp-flags=psh,ack
2 time=0.733 num=3 direction=rx src-mac=00:21:D8:XX:XX:XX dst-mac=4C:5E:0C:XX:XX:XX interface=ether1 src-address=x.x.x.73:50594 dst-address=10.0.254.200:8291 (winbox)
protocol=ip ip-protocol=tcp size=60 cpu=14 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=29660 fragment-offset=0 ttl=127 tcp-flags=ack
3 time=0.734 num=4 direction=rx src-mac=00:21:D8:XX:XX:XX dst-mac=4C:5E:0C:XX:XX:XX interface=ether1 src-address=x.x.x.73:50594 dst-address=10.0.254.200:8291 (winbox)
protocol=ip ip-protocol=tcp size=60 cpu=14 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=29661 fragment-offset=0 ttl=127 tcp-flags=ack
4 time=0.734 num=5 direction=rx src-mac=00:21:D8:XX:XX:XX dst-mac=4C:5E:0C:XX:XX:XX interface=ether1 src-address=x.x.x.73:50594 dst-address=10.0.254.200:8291 (winbox)
protocol=ip ip-protocol=tcp size=60 cpu=14 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=29662 fragment-offset=0 ttl=127 tcp-flags=ack
5 time=0.734 num=6 direction=rx src-mac=00:21:D8:XX:XX:XX dst-mac=4C:5E:0C:XX:XX:XX interface=ether1 src-address=x.x.x.73:50594 dst-address=10.0.254.200:8291 (winbox)
protocol=ip ip-protocol=tcp size=60 cpu=14 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=29663 fragment-offset=0 ttl=127 tcp-flags=ack
6 time=1.034 num=7 direction=rx src-mac=00:21:D8:XX:XX:XX dst-mac=4C:5E:0C:XX:XX:XX interface=ether1 src-address=x.x.x.73:50594 dst-address=10.0.254.200:8291 (winbox)
protocol=ip ip-protocol=tcp size=108 cpu=14 fp=no ip-packet-size=94 ip-header-size=20 dscp=0 identification=29815 fragment-offset=0 ttl=127 tcp-flags=psh,ack
7 time=1.268 num=8 direction=rx src-mac=00:21:D8:XX:XX:XX dst-mac=4C:5E:0C:XX:XX:XX interface=ether1 src-address=x.x.x.73:50594 dst-address=10.0.254.200:8291 (winbox)
protocol=ip ip-protocol=tcp size=60 cpu=14 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=29977 fragment-offset=0 ttl=127 tcp-flags=ack
8 time=1.631 num=9 direction=rx src-mac=00:21:D8:XX:XX:XX dst-mac=4C:5E:0C:XX:XX:XX interface=ether1 src-address=x.x.x.73:50594 dst-address=10.0.254.200:8291 (winbox)
protocol=ip ip-protocol=tcp size=93 cpu=14 fp=no ip-packet-size=79 ip-header-size=20 dscp=0 identification=30164 fragment-offset=0 ttl=127 tcp-flags=psh,ack
Note that this is not happening on all traffic incoming as untagged, and not always, it seems to be related to repeated runs of the packet sniffer where the captured traffic has packets in untagged and tagged vlan.