["NEWMAN Christopher" <Christopher.Newman@xxxxxxxxxxxxxxxxxx>]

Hello all,

I'm using tshark to parse a captured packet.  Most fields are easy to
grab, but I can't figure out how to grab both VLAN tags from a stacked
Ethernet frame.  The following command returns the inner (2nd) VLAN ID:

     tshark -r test.pcap -c 1 -T fields -e vlan.id

I tried using vlan.id[0], vlan[0].id, etc. to no avail.  I also tried
the following, which returns nothing in the first column and the inner
VLAN in the second column:

     tshark -r test.pcap -c 1 -T fields -e vlan.id -e vlan.id

I know tshark can process the fields correctly because the detailed XML
and verbose options show both VLANs parsed out.  I could parse those
outputs, but I really don't want to do it that way.

Does anyone know how to handle multiple matches for using the same field
name?

Thanks in advance.

Chris