Configuring the virtual Ethernet port:

One of the advantages of the USB SharkTap is that you can have virtual Ethernet port dedicated to network sniffing, rather than reconfiguring a port sometimes used for other purposes. The following two setting are not absolutely necessary, but are recommended. The first setting minimizes the number of packets your PC will attempt to transmit over the virtual port. The SharkTap will not route any packets sent from your PC to the Network ports, but Wireshark will still show these packets, which can clutter up a capture. The second setting enables jumbo packets, which is necessary if you are sniffing a link with jumbo packets. The 3rd setting shows how to avoid having VLAN tags stripped, so you can see them in Wireshark.

LINUX: On Linux, we recommend that you simply don’t assign an IP to the virtual port. ‘Jumbo packet’ is enabled on Linux by changing the MTU. Example: sudo ifconfig usb0 mtu 4088

WINDOWS: Go to Control Panel -> Network and Sharing Center -> Change Adapter Settings, which will bring up a window like the one below.   Look for the adapter reading ASIX AX88179… (or Realtek USB GbE, or LAN7801 USB), which is “Local Area Connection 13” in the example below. Right click on that and select ‘Properties’, which will bring up the smaller window shown by the first red arrow. You can optionally unclick all of the boxes shown in yellow, but do NOT uncheck anything with 'Npcap' (packet capture). Then click on ‘Configure’ button, which will bring up the window to the right of the red arrow. Click on the ‘Advanced’ tab, then click on ‘JumboPacket’, then select 4KB.

Enabling display of VLAN tags in Wireshark:

For earlier models with Realtek RTL8153 USB chips, you just need to disable 'Priority & VLAN', and you get to this option on the same 'Properties' page as above.

A registry entry is required for later models with the Microchip LAN7801 USB chip. You must add a new string value called "NoVLANStrippingOnRx" set to "1" to HKLM\SystemCurrentControlSet\Control\Class\desired_LAN7801_instance_Number The following snip shows how to locate your "desired_LAN7801_instance_Number" and what regedit will look like when you've added the new parameter. If you set NoVLANStrippingOnRx to "0" the driver will revert to Microsoft specified NDIS driver behavior.