This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

QinQ VLAN capture filter

0

I'm trying to set up a capture filter for the following double tagged packets:

Wireshark v 1.12.4 running on Windows 8.1 with Intel PRO 1000 MT NIC

Ethernet II
Type: 0x9100
802.1Q Virtual LAN:
Type: 0x8100
802.1Q Virtual LAN:
Type: 0x0800

I have tried 'vlan' and also 'vlan and vlan' but no packets are captured. If I capture without a capture filter I can see all packets and both inner and outer VLAN tags.

Any help would be greatly appreciated.

alt text

asked 22 Apr '15, 03:21

NickR's gravatar image

NickR
66127
accept rate: 50%

edited 22 Apr '15, 03:29


One Answer:

1

answered 22 Apr '15, 04:02

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 22 Apr '15, 04:07

Thanks Kurt, that does shed some light on the issue.

I can capture the packets from a specific inner vlan using:

vlan or vlan 618
vlan 202 or vlan 618
vlan xxx or vlan 618

All of the above allow packets with an inner vlan tag of 618 to be captured.

Using 'vlan 618' alone doesn't capture any packets as expected.

Using and combination of 'vlan and vlan' or 'vlan xxx and vlan xxx' doesn't capture any packets.

I'm going to mark this as answered as I can now capture on inner vlan tag.

Thanks for the assistance.

(22 Apr '15, 05:43) NickR

I converted you answer to a comment, as that's how this site works. Please see the FAQ: https://ask.wireshark.org/faq/

(22 Apr '15, 05:45) Kurt Knochner ♦

I'm going to mark this as answered as I can now capture on inner vlan tag.
Thanks for the assistance.

O.K. You're welcome.

(22 Apr '15, 05:47) Kurt Knochner ♦

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(22 Apr '15, 06:06) grahamb ♦