2

I'm running tcpdump on a mirrored port and when I use a simple tcpdump command it shows the VLAN id:

tcpdump -i eth1 -n -e

22:02:53.308715 78:31:c1:c6:c8:9e (oui Unknown) > Broadcast, ethertype 802.1Q (0x8100), length 114: vlan 10, p 0, ethertype IPv4, redacted-MBP.home.redacted.net.netbios-ns > 192.168.10.255.netbios-ns: NBT UDP PACKET(137): REFRESH(8); REQUEST; BROADCAST

However, if I try to filter on the vlan 10 id then it doesn't show any packets:

tcpdump -i eth1 -n -e '(vlan 10)'

What am I doing wrong?

  • I tested on Fedora 23, tcpdump --version tcpdump version 4.7.4 libpcap version 1.7.4 It works. What is your distro, tcpdump version? – mmv-ru Jul 24 '16 at 0:35
  • Support for shortcuts in BPF syntax is spotty across versions; for example I have tcpdump 4.1 and libpcap 1.4.0, and the 'vlan' shortcut does not work. It isn't pretty, but this BPF will work for vlan 10: ether[12:2] = 0x8100 and ether[15] = 10 – Jeremy Dover Jul 24 '16 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.