This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I've been trying to sniff a trunk running multiple VLANs with DumpCap, and would like to filter out all VLAN traffic except the VoIP VLAN, which is VLAN 11. I have tried using the filter qualifier such as -f vlan 11 or -f "vlan 11" or -f vlan:11 None of these permutations have worked. Anyone out there had any success with using a VLAN capture filter? If so, can you elaborate?

Here is my full command-line:

dumpcap -i 2 -b files:144 -b duration:600 -f "vlan 11" -w dumptest.pcap

Thanks!

asked 17 Jan '14, 08:58

randyp's gravatar image

randyp
16225
accept rate: 0%

1

Are you actually capturing vlan-tagged frames? See the VLAN wiki page.

(17 Jan '14, 12:17) cmaynard ♦♦

On which OS is this?

(18 Jan '14, 13:50) Guy Harris ♦♦

Running WinXP. VLAN tagged packets show up when I run it through the WireShark GUI--but I will doublecheck this. I see from the DumpCap website that anytime you use a filter that contains a space, you must enclose it with quotation marks--when I do this, it acts like it takes the command, but never captures anything. Problem is, for an extended capture and for the amount of traffic, I have to use DumpCap to keep it from locking up.

(20 Jan '14, 07:28) randyp

Finally figured this one out for myself.

tshark -i1 -c 5000 -f "vlan 11" -w filname.pcapng

This syntax works just fine with the -f filter; problem was that my company laptop was running Symantec Endpoint Protection in the background. Once I turned it off, the VLANs showed up!

I was having the same issue trying to do a capture filter for certain TCP or UDP ports--that also works fine now.

dumpcap -i1 -c 5000 -f "tcp port 443" -w filename.pcapng

permanent link

answered 27 Jan '14, 10:56

randyp's gravatar image

randyp
16225
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549
×349
×66

question asked: 17 Jan '14, 08:58

question was seen: 4,319 times

last updated: 27 Jan '14, 10:56

p​o​w​e​r​e​d by O​S​Q​A