QinQ VLAN capture filter

I'm trying to set up a capture filter for the following double tagged packets:

Wireshark v 1.12.4 running on Windows 8.1 with Intel PRO 1000 MT NIC

Ethernet II
Type: 0x9100
802.1Q Virtual LAN:
Type: 0x8100
802.1Q Virtual LAN:
Type: 0x0800

I have tried 'vlan' and also 'vlan and vlan' but no packets are captured. If I capture without a capture filter I can see all packets and both inner and outer VLAN tags.

Any help would be greatly appreciated.

alt text

asked 22 Apr '15, 03:21

NickR
66●1●2●7
accept rate: 50%

edited 22 Apr '15, 03:29

One Answer:

active answers oldest answers newest answers popular answers

See my answer to a very similar question:

https://ask.wireshark.org/questions/31953/unusual-behavior-with-stacked-vlan-tags-and-capture-filter/32006

Regards
Kurt

permanent link

answered 22 Apr '15, 04:02

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 22 Apr '15, 04:07

Thanks Kurt, that does shed some light on the issue.

I can capture the packets from a specific inner vlan using:

vlan or vlan 618
vlan 202 or vlan 618
vlan xxx or vlan 618

All of the above allow packets with an inner vlan tag of 618 to be captured.

Using 'vlan 618' alone doesn't capture any packets as expected.

Using and combination of 'vlan and vlan' or 'vlan xxx and vlan xxx' doesn't capture any packets.

I'm going to mark this as answered as I can now capture on inner vlan tag.

Thanks for the assistance.

(22 Apr '15, 05:43) NickR

I converted you answer to a comment, as that's how this site works. Please see the FAQ: https://ask.wireshark.org/faq/

(22 Apr '15, 05:45) Kurt Knochner ♦

I'm going to mark this as answered as I can now capture on inner vlan tag.
Thanks for the assistance.

O.K. You're welcome.

(22 Apr '15, 05:47) Kurt Knochner ♦

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(22 Apr '15, 06:06) grahamb ♦

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

capture ×549
filter ×349
vlan ×66
double ×3
tagged ×1

question asked: 22 Apr '15, 03:21

question was seen: 9,107 times

last updated: 22 Apr '15, 06:06

QinQ VLAN capture filter

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions