Hello,
I have wireshark-1.10.7-1.
when I sniff LACP (Link Aggregation Control Protocol) traffic, I see "LACP"
in the prtocol column, and the ethertype is 0x8809 (Slow Protocols (IEEE 802.3))
However, I need to sniff LACP traffic also from the command line with tshark
(on Linux).
I see:
tshark -d 0x8809 -i em1
I get this error:
tshark: Parameter "0x8809" doesn't follow the template
"<layer_type>==<selector>,<decode_as_protocol>"
tshark: Unknown layer type -- 0x8809
And when running "tshark -d", which displays the list of all protocols,
I don't see the LACP protocol.
It is strange that with the wireshark GUI client, 0x8009 is recognized as LACP,
while "thsark -d" does not show the LACP.
Please adive, how can I sniff with tshark client with filtering for 0x8009
Ehtertype (LACP). (with -d ethertype==...)
regards,
Kevin