Wireshark-users: Re: [Wireshark-users] Filtering both vlan-tagged as untagged frames with an ip-f

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 2 May 2007 08:47:32 +0200
On Tue, May 01, 2007 at 11:38:26PM -0700, Guy Harris wrote:
> Sake Blok wrote:
> > 
> > Might this be a WinPcap bug?
> 
> Does it count as a bug if it's documented to work that way? :-)

Most definitely not :-)


>               specified  vlan_id.   Note  that  the  first vlan keyword
>               encountered in expression changes  the  decoding  offsets
>               for  the  remainder  of expression on the assumption that
>               the packet is a VLAN packet.

Oops, I shamefully have to admit I need to RTFM more often ;-)

I did manage to get a good filter after all using trial and error. But
now I know *why* only this filter worked.

Thanks,  Cheers,


Sake