Packet analysis lab 3 of 12
Ethernet frames: 802.1Q tags and a duplicate address
Tap the trunk between a switch and a router-on-a-stick, read 802.1Q tags and watch one ping cross the trunk twice in two VLANs. Then use ARP and Wireshark's duplicate-address warning to find the label printer that stole the tills' gateway address, and fix it.
Run this lab
It needs Lite: its 6 nodes are set to 6 vCPU and 3,840 MB in total. That fits the free demo too.
In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 03 - Ethernet frames - 802-1Q tags and a duplicate address
- Level
- Intermediate
- Time
- About 60 minutes
- Nodes need
- 6 vCPU, 3,840 MB
- Smallest plan
- Lite
The scenario
Fellside Outdoor's Kendal shop has two VLANs on one switch: STAFF (VLAN 10) and TILLS (VLAN 20). Router R1 routes between them over a single trunk (router-on-a-stick). Since a new label printer, PRN1, was plugged in last week, the till TILL1 keeps losing the back office, sometimes for minutes at a time. You've put your workstation WS in-line on the trunk as a tap, so you see every frame between SW1 and R1, tags and all.
| Device | Interface | VLAN | Address | Connects to |
|---|---|---|---|---|
| R1 | Gi0/0.10 / Gi0/0.20 | 10 / 20 | 10.40.10.1/24 / 10.40.20.1/24 | trunk, through WS |
| SW1 | Gi0/0 | trunk 10, 20 | none | WS eth0 |
| PC10 | eth0 | 10 | 10.40.10.21/24, gateway .1 | SW1 Gi0/1 |
| TILL1 | eth0 | 20 | 10.40.20.21/24, gateway .1 | SW1 Gi0/2 |
| PRN1 | eth0 | 20 | should be 10.40.20.60/24 | SW1 Gi0/3 |
| WS | br0 (eth0 + eth1) | all | none | the tap |
Your workstation, WS. Open WS's console (a remote desktop, root / eve) and start Wireshark from Applications > Internet > Wireshark. Write answers in /root/answers.txt (pluma /root/answers.txt &).
What you’ll practise
- Identify the fields of an Ethernet frame, common EtherTypes and unicast, broadcast and multicast MAC addresses
- Read an 802.1Q tag and explain how it changes the frame header
- Follow a routed packet across a trunk in two VLANs, with new MAC addresses and a lower TTL
- Explain ARP requests, replies and gratuitous ARP, and filter each type
- Find a duplicate IP address from ARP evidence and fix it
The tasks
- Start the hosts
- Read an Ethernet frame
- Read the 802.1Q tag
- ARP requests, replies and gratuitous ARP
- Find the owner and fix it
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- SW1
Gi0/0to WSeth0 - WS
eth1to R1Gi0/0 - SW1
Gi0/1to PC10eth0 - SW1
Gi0/2to TILL1eth0 - SW1
Gi0/3to PRN1eth0
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| SW1 | Cisco IOSvL2 | viosl2-adventerprisek9-m.ssa.high_iron_20200929 | 1 vCPU, 768 MB |
| WS | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
| R1 | Cisco IOSv | vios-adventerprisek9-m.SPA.159-3.M6 | 1 vCPU, 512 MB |
| PC10 | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
| TILL1 | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
| PRN1 | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
Packet analysis with Wireshark and tcpdump guided labs.Open
03 - Ethernet frames - 802-1Q tags and a duplicate addressand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More Packet analysis labs
Related labs in other courses
CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.