I want tcpdump to capture VLAN 1000 or VLAN 501.
man pcap-filter says:
The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression increments the filter offsets by 4.
When I do:
tcpdump -vv -i eth1 \( vlan 1000 \) and \( ip host 10.1.1.98 or ip host 10.1.1.99 \)
I get captured packets.
But when I do:
tcpdump -vv -i eth1 \( vlan 1000 or vlan 501 \) and \( ip host 10.1.1.98 or ip host 10.1.1.99 \)
I don't get any packets -- I presume because of the "increment by 4" behavior described in the man page.
How can I capture traffic on more than one VLAN at a time?