Tech Tips

OmniEngine Desktop

• How do I capture VLAN packets?
• I have a firewall installed. What port must be added to connect to my engine?
• I installed the engine successfully but why can't I start the OmniEngine service?
• Is there a way to only capture the header of a packet?
• I created a filter but it is not showing up in the filter list. Why?

First be sure the analyzer is placed where the tagged frames exist, this is generally on a switch trunk (a link that connects switch-to-switch).

Second verify that your switch is not stripping the VLAN tags, you may need to contact your switch manufacturer.

Lastly, the network interface card may strip 802.1q tags at the adapter/driver level. By default, Intel adapters strip the VLAN tag before passing it up the stack. Some Broadcom adapters also exhibit this behavior. Possible fixes for Intel and Broadcom adapters can be found below, for other adapters please contact your NIC manufacturer.

Unsupported Fix for Broadcom Adapters:

** Please backup your registry before making these modifications. **

Please look for the following registry key and follow the steps listed below. This fix is not supported by WildPackets.

HKEY_LOCAL_MACHINE-->SYSTEM-->CurrentControlSet

1. You need to find the right instance of the driver in the registry.
2. Run Regedit.
3. Search for "TxCoalescingTicks" and ensure this is the only instance that you have.
4. Right-click on the instance number (eg. 0008) and add new string value.
5. Enter "PreserveVlanInfoInRxPacket" and give it value "1".

Unsupported Fix for Intel Adapters:

http://www.intel.com/support/network/sb/cs-005897.htm

Another solution is to purchase a tap. TAPs are passive and independent of the network. Please call (925) 937-3200 or write to sales@wildpackets.com to find out more about TAPs.

OmniEngine uses port 6367/TCP/UDP.

Omni Engine is dependent on the "Workstation" service.

If the "Client for Microsoft Networks" driver is not installed, the service "Workstation" is also not installed, which may cause Omni Engine to not start up.

Yes, here is how to do it:

1. Click View/Filters to bring up the filters window.
2. Click the Insert button (Green )
3. Select Simple or Advanced for Filter Type.
4. Select Protocol Filter.
5. Select the Protocol and check Slice to Header.

Be sure you have clicked the yellow bar "Click here to send changes".