Re: pcap filters on a VLAN

[sthaug () nethelp no]

> Will a filter like the one below capture IP packets encapsulated in 
> Ethernet frames and IP packets in Ethernet frame with a 802.1q VLAN header?
>
>     ether proto 0x0800

It will capture normal IP in Ethernet. It will not capture IP in
Ethernet with a 802.1q VLAN header.


> If not, how does one specify capturing IP packets within an Ethernet 
> frame with a 802.1q VLAN header?

ether[12:2]==0x8100 and ether[16:2]==0x800
or
ether proto 0x8100 and ether[16:2]==0x800

> What about filter that specify only UDP or TCP ports? Will those filters 
> work for both Ethernet frames and 802.1q VLAN frames?

No.

Steinar Haug, Nethelp consulting, sthaug () nethelp no
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe