I'm trying to figure out the vlan tagged packets that my host receives or sends to other hosts. I tried

tcpdump -i eth1 vlan 0x0070

But it didnt work. Has anyone tried to view the vlan packets through tcpdump before? Couldn't find much help searching the web!

  • Are values in hex allowed? The man page doesn't say anything about it. Try it in decimal. vlan 112 Dec 19, 2013 at 1:00
  • 2
    Are you expecting it to be sending VLAN tagged traffic? Is it connected to a trunk port on the switch?
    – Andrew
    Dec 19, 2013 at 1:11
  • No, I expect it to listen on eth1 for vland tagged traffic.
    – madCode
    Dec 19, 2013 at 17:18
  • Not sure you will find It there. Try -i eth1.112 instead.
    – Veniamin
    Dec 19, 2013 at 18:18

3 Answers 3


If your host is connected to an access port, the switch will likely strip the VLAN tag off before it reaches your host. As a result, running TCPDump on the host in question will never see the VLAN tags.

You would need to setup a SPAN port and/or introduce a network tap into your network somewhere to grab traffic before the tags are dropped off the packets in order to see them in a network dump/trace.

  • 1
    Note that "vlan" increases the filter start offset by four bytes. Combining it with other primitives, e.g. "vlan or ip host" may not do what you expect. Dec 18, 2013 at 23:56
  • 1
    To be accurate, a switch does not strip VLAN tags off a frame before sending it out an access port, it only adds VLAN tagging to frames before it sends them out a trunk/tagged port (and they are removed once received by the switch on the other side).
    – YLearn
    Dec 19, 2013 at 0:36

you can actually use linux to "decode" 802.1q (vlan tagging). you can effectively turn linux into a "router on a stick" and route between vlans, with a single ethernet port, on a fancy cisco layer 2 switch (that has lots of vlans).

the main ethernet has "subinterfaces" which correscpond with the vlan id. you can then route, and iptables (firewall) the subinterfaces individually.

this is an easy way to have a perimeter linux firewall connected to isp, and 10 vlans behind it, but only using a single ethernet interface.

dot q is the standard, even tho cisco thinks it made it up, so it runs great on linux.

EDIT: to enable this

modprobe 8021q

you can then run tcpdump to listen on the subinterfaces

  • 1
    This still would not see vlan tags unless the port he is connects to is tagging the traffic.
    – Rex
    Dec 19, 2013 at 1:54
  • @Rex, thats right, the other side of ethernet cable must be conf'ed as, what cisco calls, "switchport mode trunk" or vendor equivelent
    – nandoP
    Dec 19, 2013 at 6:41

I think you're using the wrong tool to be honest - tcpdump is more tied to IP (L3) whereas VLANs are a feature of L2 - try using wireshark instead.

  • 1
    tcpdump is suited for L2 - L4 and also application layer of some protocols. tcpdump -e shows more information from the Ethernet header including VLAN tags. Feb 5, 2019 at 9:05
  • And still tshark the WireShark CLI frontend is way more powerful than tcpdump methinks. Jun 2, 2020 at 14:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .