Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says:

The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression increments the filter offsets by 4.

When I do:

tcpdump -vv -i eth1 \( vlan 1000 \) and \( ip host or ip host \)

I get captured packets.

But when I do:

tcpdump -vv -i eth1 \( vlan 1000 or vlan 501 \) and \( ip host or ip host \)

I don't get any packets -- I presume because of the "increment by 4" behavior described in the man page.

How can I capture traffic on more than one VLAN at a time?

share|improve this question

migrated from Oct 29 '10 at 17:22

This question came from our site for computer enthusiasts and power users.

up vote 7 down vote accepted

I remembered that you can examine the packet bytes directly. So looking directly into the ethernet header works:

tcpdump -vv -i eth1 '( vlan and ( ether[14:2] & 0xfff == 1000 or ether[14:2] & 0xfff == 501 ) ) and ( ip host or ip host )'

Don't forget the :2, this is a 2 byte field -- I got stuck on this for a while.

share|improve this answer

It seems the vlan filter shifts the packet contents....

share|improve this answer
Please don't post link-only answers. They are low-quality, because links can change/go stale. It's best to include the necessary details directly in your post, and provide the link only for reference. – Castaglia Apr 6 at 18:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.