> Will a filter like the one below capture IP packets encapsulated in > Ethernet frames and IP packets in Ethernet frame with a 802.1q VLAN header? > > ether proto 0x0800
It will capture normal IP in Ethernet. It will not capture IP in Ethernet with a 802.1q VLAN header. > If not, how does one specify capturing IP packets within an Ethernet > frame with a 802.1q VLAN header? ether[12:2]==0x8100 and ether[16:2]==0x800 or ether proto 0x8100 and ether[16:2]==0x800 > What about filter that specify only UDP or TCP ports? Will those filters > work for both Ethernet frames and 802.1q VLAN frames? No. Steinar Haug, Nethelp consulting, [EMAIL PROTECTED] - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
