This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all,

Is there a way to display both the values of the inner and the outer VLAN IDs of a Q-in-Q packet using tshark -T fields? Wireshark display filters allow defining conditions on both values simultaneously: for instance "vlan.id == 1 and vlan.id == 2" matches Q-in-Q packets that have their outer and inner VLAN IDs set to 1 and 2, respectively. However, the output of tshark -i eth1 -Tfields -e vlan.id -e vlan.id has its first column empty while the second column contains the value of the outer VLAN IDs.

Thanks!

asked 28 Jul '15, 08:10

yvan's gravatar image

yvan
6113
accept rate: 0%


From the tshark usage output (1.12.6):

-E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as
                           aggregator

Using the occurence=a option you'll get all vlan tags, not sure how they come out though, all in the first column, or over multiple columns.

permanent link

answered 28 Jul '15, 10:29

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(29 Jul '15, 04:58) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×66
×5

question asked: 28 Jul '15, 08:10

question was seen: 2,797 times

last updated: 29 Jul '15, 04:58

p​o​w​e​r​e​d by O​S​Q​A