Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says:

The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression increments the filter offsets by 4.

When I do:

tcpdump -vv -i eth1 \( vlan 1000 \) and \( ip host 10.1.1.98 or ip host 10.1.1.99 \)

I get captured packets.

But when I do:

tcpdump -vv -i eth1 \( vlan 1000 or vlan 501 \) and \( ip host 10.1.1.98 or ip host 10.1.1.99 \)

I don't get any packets -- I presume because of the "increment by 4" behavior described in the man page.

How can I capture traffic on more than one VLAN at a time?

share|improve this question

migrated from superuser.com Oct 29 '10 at 17:22

This question came from our site for computer enthusiasts and power users.

1 Answer 1

up vote 5 down vote accepted

I remembered that you can examine the packet bytes directly. So looking directly into the ethernet header works:

tcpdump -vv -i eth1 \( vlan and \( ether[14:2] \& 0xfff == 1000 or ether[14:2] \& 0xfff == 501 \) \) and \( ip host 10.1.1.98 or ip host 10.1.1.99 \)

Don't forget the :2, this is a 2 byte field -- I got stuck on this for a while.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.