Learn packet analysis with challenging Wireshark labs (+25 advanced PCAP case-studies) !
LabLab Platform
Info·

Unraveling Layer 2 Problems: Expert Tips for Troubleshooting Network Issues

Oliver Ripka Oliver Ripka

Layer 2 problems are common in network environments and can cause significant performance issues or even complete network outages. Troubleshooting these problems can be challenging, especially in complex environments like hospitals where equipment is frequently sanitized and older devices require specific port configurations. In this article, we'll discuss the most frequent Layer 2 issues and provide expert tips for solving them using Wireshark, the world's foremost network protocol analyzer.

Network Loops

Network loops occur when there are multiple paths for data to travel between two devices, resulting in broadcast storms and performance degradation. To identify and resolve network loops, use Wireshark's built-in Loop Detection feature. Analyze the captured data for excessive broadcast or multicast traffic, and look for MAC address flapping between multiple switch ports.

Wireshark Tip: Use the display filter eth.dst[0] & 1 to focus on broadcast and multicast traffic.

VLAN Mismatches

VLAN mismatches happen when two devices on the same network are configured with different VLAN settings. This can result in communication failures or unintended traffic routing. To diagnose VLAN mismatches, capture the traffic on both devices and compare the VLAN tags in the captured frames.

Wireshark Tip: Use the display filter vlan to view only frames with VLAN tags.

Native VLAN Mismatches

Native VLAN mismatches occur when the native VLAN configured on a trunk port differs between two connected devices. This can cause unexpected behavior and communication issues. To identify native VLAN mismatches, capture the traffic on both trunk ports and look for discrepancies in the untagged frames.

Wireshark Tip: Use the display filter vlan.id == 0 or !vlan to focus on untagged frames.

Interface Access/Trunk Mismatches

Interface mismatches happen when one device is configured as an access port while the other is configured as a trunk port. This can result in traffic being dropped or misrouted. Analyze the captured traffic to determine if frames are being sent with or without VLAN tags and verify the port configurations on both devices.

Wireshark Tip: Use the display filter eth.type == 0x8100 to show frames with 802.1Q VLAN tags.

DTP, Etherchannel Configuration Mismatches

DTP (Dynamic Trunking Protocol) and Etherchannel configuration mismatches can cause trunk and port channel issues. Capture the traffic on the relevant interfaces and look for DTP negotiation messages or Etherchannel LACP (Link Aggregation Control Protocol) frames to diagnose the problem.

Wireshark Tip: Use the display filters dtp and lacp to focus on DTP and LACP frames, respectively.

Duplex/Speed Mismatches

Duplex and speed mismatches occur when two connected devices have different duplex (half or full) or speed (10, 100, or 1000 Mbps) settings. These mismatches can cause performance issues, collisions, and dropped frames. Check the interface settings on both devices and capture the traffic to identify any CRC errors, late collisions, or other indicators of duplex/speed mismatches.

Wireshark Tip: Use the display filter eth.dst[0] & 1 and eth.type == 0x2000 to focus on collision fragments and use the built-in Wireshark expert system to identify potential issues.

By these Wireshark tips and techniques, you'll be better equipped to diagnose and resolve Layer 2 problems in your network environment. For even more in-depth knowledge and real-world examples, check out our online PCAP analyzer, PacketSafari (https://app.packetsafari.com), and our training course WIRED for Packet Analysis (https://oripka.de/en/wired/).