Tech Tips

• How do I capture VLAN packets?
• I have a firewall installed. What port must be added to connect to my engine?
• I installed the engine successfully but why can’t I start the OmniEngine service?
• Is there a way to only capture the header of a packet?
• Can a NIC connected to a SPAN/Mirror port also be used for network services?
• I created a filter but it is not showing up in the filter list. Why?
• I do not have any captures running but when I try to create a new capture I receive "An error occurred. Not implemented (Error code: 0x80004001)". Why am I getting this error?

First be sure the analyzer is placed where the tagged frames exist, this is generally on a switch trunk (a link that connects switch-to-switch).

Second verify that your switch is not stripping the VLAN tags, you may need to contact your switch manufacturer.

Lastly, the network interface card may strip 802.1q tags at the adapter/driver level. By default, Intel adapters strip the VLAN tag before passing it up the stack. Some Broadcom adapters also exhibit this behavior. Possible fixes for Intel and Broadcom adapters can be found below, for other adapters please contact your NIC manufacturer.

Unsupported Fix for Broadcom Adapters:

** Please backup your registry before making these modifications. **

Please look for the following registry key and follow the steps listed below. This fix is not supported by WildPackets.

HKEY_LOCAL_MACHINE-->SYSTEM-->CurrentControlSet

1. You need to find the right instance of the driver in the registry.
2. Run Regedit.
3. Search for "TxCoalescingTicks" and ensure this is the only instance that you have.
4. Right-click on the instance number (eg. 0008) and add new string value.
5. Enter "PreserveVlanInfoInRxPacket" and give it value "1".

Unsupported Fix for Intel Adapters:

http://support.intel.com/support/network/sb/CS-009720.htm

Another solution is to purchase a tap. TAPs are passive and independent of the network. Please call (925) 937-3200 or write to sales@wildpackets.com to find out more about TAPs.

OmniEngine uses port 6367/TCP/UDP.

Omni Engine is dependent on the "Workstation" service.

If the "Client for Microsoft Networks" driver is not installed, the service "Workstation" is also not installed, which may cause Omni Engine to not start up.

Yes, here’s how:

1. Click View/Filters to bring up the filters window.
2. Click the Insert button (Green +)
3. Select Simple or Advanced for Filter Type.
4. Select Protocol Filter.
5. Select the Protocol and check Slice to Header.

You will need an additional adapter to use for network services or use a multi-port adapter like the Intel dual or quad port adapters. These cards could connect via one port and capture on the additional, available ports.

Be sure you have clicked the yellow bar “Click here to send changes”.

OmniEngine Desktop only supports one capture at a time, this includes Idle captures. You must go to the Captures tab and delete the Idle capture, if needed save the capture before deleting it. If you are interested in running multiple captures, please take a look at our OmniEngine Workgroup and Enterprise products.