Wireshark · Wireshark-users: Re: [Wireshark-users] Capture filter with multiple VLANs

[Todd Adamson <tadamson@xxxxxxxxxxx>]

Ah. And that is why we ask the questions.  I didn't think of 
moving farther down the stack for the capture filters.  
Thanks to everyone who sent the idea.

Todd

On 8/1/2019 8:52 AM, Maynard, Chris via Wireshark-users wrote:
> How about a capture filter such as this?
>
> "vlan and not (ether[14:2]&0x0fff = 20 or ether[14:2]&0x0fff = 30)"
>
> - Chris
> See also: https://ask.wireshark.org/question/3877/vlan-filter/
>
>
> > -----Original Message-----
> > From: Wireshark-users [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On
> > Behalf Of Todd Adamson
> > Sent: Wednesday, July 31, 2019 6:41 PM
> > To: Wireshark-users@xxxxxxxxxxxxx
> > Subject: [Wireshark-users] Capture filter with multiple VLANs
> >
> > Is it possible to create a capture filter to deal with multiple vlans?  What I
> > would like to do is:
> >
> > not (vlan 20 or vlan 30)
> > or
> > not vlan 20 and not vlan 30
> >
> > So far, from what I've read, only the first vlan element is used in the filter.
> >
> > Ideas?
> >
> > Thanks.
> >
> > Todd