Wireshark mailing list archives

Extracting outer MAC Address


From: Rayne <hjazz6 () ymail com>
Date: Mon, 19 Jan 2015 06:00:33 +0000 (UTC)

Hi all,
I have vlan packets that contain 2 Ethernet headers, and I would like to extract all source MAC addresses from the 
first (outer) Ethernet header. However, tshark automatically extracts the second (inner) MAC address.
What I have is
tshark -r file.pcap -T fields -e eth.src -w output.pcap
How do I extract only the outer MAC address using tshark?
Thank you.
Regards,Rayne
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

Current thread: