I'm trying to set up a capture filter for the following double tagged packets: Wireshark v 1.12.4 running on Windows 8.1 with Intel PRO 1000 MT NIC Ethernet II I have tried 'vlan' and also 'vlan and vlan' but no packets are captured. If I capture without a capture filter I can see all packets and both inner and outer VLAN tags. Any help would be greatly appreciated.
asked 22 Apr '15, 03:21  NickR edited 22 Apr '15, 03:29 |
One Answer:
See my answer to a very similar question: Regards answered 22 Apr '15, 04:02  Kurt Knochner ♦ edited 22 Apr '15, 04:07 |
Thanks Kurt, that does shed some light on the issue.
I can capture the packets from a specific inner vlan using:
vlan or vlan 618
vlan 202 or vlan 618
vlan xxx or vlan 618
All of the above allow packets with an inner vlan tag of 618 to be captured.
Using 'vlan 618' alone doesn't capture any packets as expected.
Using and combination of 'vlan and vlan' or 'vlan xxx and vlan xxx' doesn't capture any packets.
I'm going to mark this as answered as I can now capture on inner vlan tag.
Thanks for the assistance.
I converted you answer to a comment, as that's how this site works. Please see the FAQ: https://ask.wireshark.org/faq/
O.K. You're welcome.
If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.