Wireshark-users: Re: [Wireshark-users] capture filters
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 31 Dec 2007 15:58:42 -0800
Witton, David wrote:


> What OS are you running on the machine doing the capture?  And what type
> of network adapter are you capturing on?

XP pro, vmware virtual machine. VMware Accellerated AMD PCNet Adapter


So that's probably a (virtual) Ethernet adapter.


> And, if this is on Ethernet, are you using VLANs?  If so, is the TCP
> traffic to and from the host running Wireshark on a VLAN?  (I.e., does
> it have a VLAN header?)

Forgive my ignorance, I'm not sure how to check for a VLAN header,
In Wireshark or TShark, in the packet detail pane, there will be an "802.1Q Virtual LAN" entry below "Ethernet II" and above "Internet Protocol" for a packet with a VLAN header. (Or maybe more than one "802.1Q Virtual LAN" header for a VLAN inside a VLAN, etc., but that's probably rarer.) 

(Also, this is TCP over IPv4, not TCP over IPv6, right?)