Ethereal-users: Re: [Ethereal-users] VLAN tag removal.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 30 Mar 2001 12:09:02 -0800 (PST)
> Is it possible to take a datastream, either from a ethereal capture
> file, or live, and remove vlan tags so that other, less vlan friendly,
> packages can perform analysis on the output?

It would be possible to write a program to to that, using libpcap; I
don't know of any programs that already do that, though.

There's a Perl module (Net::Raw or something such as that) which
provides a libpcap interface, so it could perhaps be written in Perl;
there may be packages for other somewhat more convenient languages than
C as well.

Of course, if you do that:

> I have a variety of tools and utilities that I use to parse tcpdump type
> output for performing statistical analysis, but they're barfing on the
> data captured by tcpdump 3.6.2 and tethereal 0.8.16 due to the vlan
> headers.

...if you have the source to those tools, another possibility would be
to just teach those tools how to handle VLAN frames.