Ethereal-users: Re: [Ethereal-users] Sniffing VLAN tagged packets with capture filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Thu, 29 Apr 2004 23:13:35 +0200
Phil Entz wrote:
<I have been using Ethereal for about a year now and am a very satisfied
<user. Recently, I discovered I cannot capture packets with 802.1q tags
<while also using a capture filter. It appears the filter tests on the
<802.1q tag and since the filter criteria are not met the packet is not
<captured. Does anyone have a way around this? Is there a way to
<construct a capture filter to not check on the VLAN 802.1q tag?
< Any help or hints greatly appreciated. I run Ethereal 0.10.3 on a Windows
2000 platform.

If there are VLAN tags in the packets then it will not work with a capture
filter like "port 7030".
You'll have to use filter like "vlan and port 7030". The "vlan" keyword will
be used when compiling the remainder of
the expression.
http://www.tcpdump.org/lists/workers/2002/07/msg00109.html
There might be some limitations that I'm not aware of.

If you want to capture packets with port number 7030 independently if there
is a VLAN header
or not, I guess that you could use a filter like "port 7030 or (vlan and
port 7030)"

http://windump.polito.it/docs/manual.htm