This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to get individual vlan information of same frame from a Wireshark 802.1q packet

0

Hi Team,

I have a wireshark packet where two vlan headers are there. I would like to fetch individual vlan information using tshark on Linux environment, but seems not working properly.

tshark -Tfields -e vlan.priority frame.number==2 -r ft3088_1_ipv6_static_negative_propagation_port2_1_capture.pcap

Could suggest how to do this . Thanks in advance. The pcap file can be downloaded here

link text

asked 30 Jun '15, 00:20

udaya's gravatar image

udaya
21●4●4●7
accept rate: 100%

One Answer:

0

Hi

try below syntax

tshark.exe -T fields -e vlan.priority -Y frame.number==2 -r ft3088_1_ipv6_static_negative_propagation_port2_1_capture.pcap

6,0

answered 30 Jun '15, 02:40

scheehan's gravatar image

scheehan
31●1
accept rate: 100%

edited 30 Jun '15, 02:52

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206

Thanks. I tried the same but NOT working. I am with following tshark details. Is it related to version ..

    tshark: invalid option -- Y
TShark 1.0.8
Dump and analyze network traffic.
See http://www.wireshark.org for more information.
(30 Jun '15, 04:48) udaya

Can you not upgrade your version of tshark, 1.0.8 is pre-historic?

(30 Jun '15, 04:52) grahamb ♦
1

Or try substituting -R for -Y.

(30 Jun '15, 06:46) cmaynard ♦♦

Thanks I installed 1.6.7 and tried with -R worked perfect !!!

:)

(30 Jun '15, 21:47) udaya