capture Q-in-Q VLAN IDs with tshark -T fields

Question

Hi all,

Is there a way to display both the values of the inner and the outer VLAN IDs of a Q-in-Q packet using tshark -T fields? Wireshark display filters allow defining conditions on both values simultaneously: for instance "vlan.id == 1 and vlan.id == 2" matches Q-in-Q packets that have their outer and inner VLAN IDs set to 1 and 2, respectively. However, the output of tshark -i eth1 -Tfields -e vlan.id -e vlan.id has its first column empty while the second column contains the value of the outer VLAN IDs.

Thanks!

Answer 1

From the tshark usage output (1.12.6):

-E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as
                           aggregator

Using the occurence=a option you'll get all vlan tags, not sure how they come out though, all in the first column, or over multiple columns.