capture filter with multiple vlans

[Filonenko Alexander-AAF013]

Capture filters seem to accept first vlan tag and drop the rest. Are there any tricks to handle more than one vlan?

"vlan 102 or vlan 103 or vlan 147 or vlan 122"
same as "vlan 102"

"not vlan 102 and not vlan 144"
same as "not vlan 102"

"not (vlan 102 or vlan 101)"
same as "not vlan 102"

"not ((vlan 102) or (vlan 101))"
same as "not vlan 102"

Thank you,
Alex Filonenko

[Guy Harris]

Post by Filonenko Alexander-AAF013
Capture filters seem to accept first vlan tag and drop the rest.

$ man pcap-filter # or "man tcpdump", for versions of libpcap prior to 1.0.0

...

vlan [vlan_id]
True if the packet is an IEEE 802.1Q VLAN packet. If [vlan_id]
is specified, only true if the packet has the specified vlan_id.
Note that the first vlan keyword encountered in expression
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
changes the decoding offsets for the remainder of expression on
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
the assumption that the packet is a VLAN packet. The vlan
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[vlan_id] expression may be used more than once, to filter on
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
VLAN hierarchies. Each use of that expression increments the
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
filter offsets by 4.
^^^^^^^^^^^^^^^^^^^

For example:
vlan 100 && vlan 200
filters on VLAN 200 encapsulated within VLAN 100, and
vlan && vlan 300 && ip
filters IPv4 protocols encapsulated in VLAN 300 encapsulated
within any higher order VLAN.

Post by Filonenko Alexander-AAF013
Are there any tricks to handle more than one vlan?

Unfortunately, none that I know of.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Gerald Combs]

Post by Guy Harris

Post by Filonenko Alexander-AAF013
Are there any tricks to handle more than one vlan?

Unfortunately, none that I know of.

Would something like

vlan and ( ether[14] & 0xfff == 101 or ether[14] & 0xfff == 201 )

work?

[Sake Blok]

Post by Gerald Combs

Post by Guy Harris

Post by Filonenko Alexander-AAF013
Are there any tricks to handle more than one vlan?

Unfortunately, none that I know of.

Would something like
vlan and ( ether[14] & 0xfff == 101 or ether[14] & 0xfff == 201 )
work?

Yes, I was testing something like that too and it works:

vlan and (ether[14:2]&0x0fff = 102 or ether[14:2]&0x0fff = 103)

Cheers,


Sake

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Filonenko Alexander-AAF013]

Post by Sake Blok

Post by Gerald Combs

Post by Guy Harris

Post by Filonenko Alexander-AAF013
Are there any tricks to handle more than one vlan?

Unfortunately, none that I know of.

Would something like
vlan and ( ether[14] & 0xfff == 101 or ether[14] & 0xfff == 201 )
work?

vlan and (ether[14:2]&0x0fff = 102 or ether[14:2]&0x0fff = 103)
Cheers,
Sake

Works great! Thank you