Wireshark-users: Re: [Wireshark-users] capture filter with multiple vlans
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Filonenko Alexander-AAF013 <Alex.Filonenko@xxxxxxxxxxxx>
Date: Tue, 9 Mar 2010 12:24:59 -0500
>On 4 mrt 2010, at 19:03, Gerald Combs wrote:
>
>> Guy Harris wrote:
>>> On Mar 3, 2010, at 8:24 AM, Filonenko Alexander-AAF013 wrote:
>>>> Are there any tricks to handle more than one vlan?
>>> 
>>> Unfortunately, none that I know of.
>> 
>> Would something like
>> 
>>    vlan and ( ether[14] & 0xfff == 101 or ether[14] & 0xfff == 201 )
>> 
>> work?
>
>Yes, I was testing something like that too and it works:
>
>vlan and (ether[14:2]&0x0fff = 102 or ether[14:2]&0x0fff = 103)
>
>Cheers,
>
>
>Sake
Works great! Thank you