Re: Capture filter with multiple VLANs

[Jaap Keuter <jaap.keuter () xs4all nl>]

Hi,

For this you have to go lower in the stack and access the packet bytes directly.

Have a look at proto [ expr : size ], where proto is ether. Now you can access the bytes in the ethernet frame directly.
So start looking for 8100 as the ethertype, then extend the expression to make comparisons for the VID field in the 
VLAN header.

Hope it helps.
Jaap


> On 1 Aug 2019, at 00:40, Todd Adamson <tadamson () routers com> wrote:
>
> Is it possible to create a capture filter to deal with multiple vlans?  What I would like to do is:
>
> not (vlan 20 or vlan 30)
> or
> not vlan 20 and not vlan 30
>
> So far, from what I've read, only the first vlan element is used in the filter.
>
> Ideas?
>
> Thanks.
>
> Todd

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe