I appreciate the reply, Steve. Attached a pcap file with a stacked
frame.
Here's some of the stuff I tried to get both VLAN IDs:
> tshark -r stacked_vlans_1pkt.pcap -T fields -e vlan.id
102
> tshark -r stacked_vlans_1pkt.pcap -T fields -e vlan.id -e vlan.id
102
> tshark -r stacked_vlans_1pkt.pcap -T fields -e vlan[0].id
tshark: No match.
> tshark -r stacked_vlans_1pkt.pcap -T fields -e vlan[1].id
tshark: No match.
> tshark -r stacked_vlans_1pkt.pcap -T fields -e vlan.id.0
> tshark -r stacked_vlans_1pkt.pcap -T fields -e vlan.id.1
If anyone gets it to work, it should return an outer VLAN 101 and inner
VLAN 102.
Thanks,
Chris
-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Stephen
Fisher
Sent: Monday, September 29, 2008 1:41 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Filtering multiple VLAN tags
On Thu, Sep 25, 2008 at 03:53:14PM -0500, NEWMAN Christopher wrote:
> I'm using tshark to parse a captured packet. Most fields are easy to
> grab, but I can't figure out how to grab both VLAN tags from a stacked
> Ethernet frame. The following command returns the inner (2nd) VLAN
> ID:
>
> tshark -r test.pcap -c 1 -T fields -e vlan.id
Do you have a *small* (1 packet is fine) capture file you are able to
share with us so we can try it ourselves and possibly fix it?
Steve
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users