[Paul Wozney <paulwozney@xxxxxxxxx>]

Fantastic.  That was it!  I took a look at the man page, and I don't
think I would ever have guessed that I had to explicitly tell the
filter to look at vlan traffic.

Thanks for your kind help.

Paul


On Tue, 30 Nov 2004 02:27:15 -0800, Guy Harris <gharris@xxxxxxxxx> wrote:
> Paul Wozney wrote:
> 
> > Oddly enough, the following does *not* work:
> >
> > root@nmsdev:/home/paul# tethereal -i eth0 -f "net 10.1.1"
> > Warning:  Couldn't obtain netmask info (eth0: no IPv4 address assigned).
> > Capturing on eth0
> > 0 packets captured
> 
> At least if the capture you sent me is an example, the problem is that
> the 10.1.1 net traffic is on a VLAN.  libpcap filters don't check both
> for regular and VLAN traffic; you have to do that explicitly, e.g.
> 
>         vlan and net 10.1.1
> 
> to capture only VLAN traffic for that network or
> 
>         net 10.1.1 or (vlan and net 10.1.1)
> 
> to capture net 10.1.1 traffic regardless of whether it's on a VLAN or
> not.  (As the second expression might imply, the libpcap filter has to
> check both separately; perhaps whoever added the "vlan" keyword didn't
> want to burden *all* captures that check for stuff past the link-layer
> header with doing two checks.)
> 
> Display/read filters aren't implemented in as low-level a fashion as are
> libpcap filters, so they can find the IP address no matter what the
> offset is.
>