Wireshark-users: Re: [Wireshark-users] Extracting outer MAC Address
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 18 Jan 2015 22:52:20 -0800
On Jan 18, 2015, at 10:00 PM, Rayne <hjazz6@xxxxxxxxx> wrote:

> Hi all,
> 
> I have vlan packets that contain 2 Ethernet headers,

I.e., you have some form of VLAN other than an IEEE VLAN?

*IEEE* VLANs do not have two full Ethernet headers; they have a regular Ethernet header, with a destination address, a source address, and a type/length field, with the type/length field having a type value such as 0x8100 or 0x9100.  That's followed by a VLAN header with a priority code point, drop eligible indicator, VLAN ID, and type field.

What sort of VLAN is this?  Can Wireshark dissect it?