Brief post, cribbed from http://forum.gns3.net/topic7559.html and https://ask.wireshark.org/questions/5996/how-to-configure-realtek-pcie-gbe-family-controller-to-capture-vlan-tag-packet

  • Update drivers
  • Find reg sub-key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
  • Add/update DWORDs:
    • MonitorModeEnabled = 1
    • MonitorMode = 1
    • *PriorityVLANTag = 0
    • SkDisableVlanStrip = 1

Basically, I had a PC running Windows 7 which was on a trunked switch port. I was expecting the native VLAN to work and remaining tagged traffic to not be visible. Turned out that the Realtek driver was stripping off the 802.1q VLAN tags and passing all traffic to the machine. The above settings resolved this.