Wireshark-users: Re: [Wireshark-users] capture filter with multiple vlans

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Sake Blok <sake@xxxxxxxxxx>
Date: Thu, 4 Mar 2010 21:54:39 +0100
On 4 mrt 2010, at 19:03, Gerald Combs wrote:

> Guy Harris wrote:
>> On Mar 3, 2010, at 8:24 AM, Filonenko Alexander-AAF013 wrote:
>>> Are there any tricks to handle more than one vlan?
>> 
>> Unfortunately, none that I know of.
> 
> Would something like
> 
>    vlan and ( ether[14] & 0xfff == 101 or ether[14] & 0xfff == 201 )
> 
> work?

Yes, I was testing something like that too and it works:

vlan and (ether[14:2]&0x0fff = 102 or ether[14:2]&0x0fff = 103)

Cheers,


Sake