tcpdump mailing list archives
Re: Addition to my question: SMTP + 802.1q Virtual LAN
From: Guy Harris <guy () alum mit edu>
Date: Fri, 19 Dec 2003 17:25:50 -0800
On Dec 17, 2003, at 6:22 AM, Cliff Clavin wrote:
I hope I found the difference. Playing around with tcpdump and filters I found out that tcpdump couldn't find tcp packets. After looking at a piece with ethereal I recognized that between the IP and Ethernet layer reside a 802.1q Virtual LAN layer.
Tcpdump should have no problem with 802.1q packets - it's supported that ever since tcpdump 3.5.
However, if you want to use a filter to find those packets, you have to use the "vlan" keyword, e.g. "vlan and tcp port 25".
Some other applications might not know about 802.1q at all. Those applications would have to be changed to know about it, or you'd have to find some program that de-802.1q-ifies packets in libpcap-format captures (I don't know of any such program).
- This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe
Current thread:
- Addition to my question: SMTP + 802.1q Virtual LAN Cliff Clavin (Dec 17)
- Re: Addition to my question: SMTP + 802.1q Virtual LAN Guy Harris (Dec 19)
- RE: Addition to my question: SMTP + 802.1q Virtual LAN Mark Bednarczyk (Dec 20)