> Thanks alot Alex, that's exactly the problem since the university uses VLAN > based on packet tags. > Actually I'm using pcap to do some packet payload processing on FreeBSD. It > seems right now that > if I use the filter "ip or (vlan and ip)", the packet returned from pcap > contains the VLAN tag. I wonder > if there's a way to let the OS to strip off the tag before deliverying?
Yes, you can configure a VLAN interface on FreeBSD, and the OS will strip the VLAN tag before delivering it to tcpdump. *But* you cannot sniff promiscuously on a VLAN interface - which means you'll only get traffic addressed directly to the host. Steinar Haug, Nethelp consulting, [EMAIL PROTECTED] - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
