I'm trying to capture a CDP packet with WinDump.exe from WinPcap. The command i'm using is
WinDump.exe -i 1 -nn -v -s 0 -c 1 "(ether[12:2]==0x88cc or ether[20:2]==0x2000)"
It captures a CDP packet fine but it seems to be cutting off the data so. The packet ends right after VTP Management Domain. but using the same filter with WireShark or TShark shows the contents of the whole packet.
I'm not sure if it's a limitation of WinDump or if I'm missing a switch, I've tried messing with the snaplen finally setting it to 0 for unlimited makes no difference. I've tried -vv and -vvv no difference.
If I view the raw packet all data is there (in unreadable HEX), it's just doesn't seem to be getting parsed by WinDump. If I use -w and open the resulting file in WireShark all content is there and parsed properly.
here's an example of the packet data I am seeing.
10:05:34.277524 CDPv2, ttl: 180s, checksum: 692 (unverified), length 475
Device-ID (0x01), length: 37 bytes: 'Test_Lab.home.local'
Version String (0x05), length: 247 bytes:
Cisco IOS Software,
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled
Platform (0x06), length: 22 bytes: ''
Address (0x02), length: 13 bytes: IPv4 (1) 192.168.0.15
Port-ID (0x03), length: 20 bytes: 'GigabitEthernet0/3'
Capability (0x04), length: 4 bytes: (0x00000028): L2 Switch, IGMP snooping
Protocol-Hello option (0x08), length: 32 bytes:
VTP Management Domain (0x09), length: 0 byte: ''
Some data has been removed by me but that is the line the data stops. In HEX format the entier packet is captured.
User contributions licensed under CC BY-SA 3.0