Wireshark mailing list archives
Sniffing LACP traffic with wireshark
From: Kevin Wilson <wkevils () gmail com>
Date: Fri, 30 May 2014 18:52:23 +0300
Hello, I have wireshark-1.10.7-1. when I sniff LACP (Link Aggregation Control Protocol) traffic, I see "LACP" in the prtocol column, and the ethertype is 0x8809 (Slow Protocols (IEEE 802.3)) However, I need to sniff LACP traffic also from the command line with tshark (on Linux). I see: tshark -d 0x8809 -i em1 I get this error: tshark: Parameter "0x8809" doesn't follow the template "<layer_type>==<selector>,<decode_as_protocol>" tshark: Unknown layer type -- 0x8809 And when running "tshark -d", which displays the list of all protocols, I don't see the LACP protocol. It is strange that with the wireshark GUI client, 0x8009 is recognized as LACP, while "thsark -d" does not show the LACP. Please adive, how can I sniff with tshark client with filtering for 0x8009 Ehtertype (LACP). (with -d ethertype==...) regards, Kevin ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Sniffing LACP traffic with wireshark Kevin Wilson (May 30)
- Re: Sniffing LACP traffic with wireshark Jaap Keuter (May 30)
- Re: Sniffing LACP traffic with wireshark Guy Harris (May 30)
- Re: Sniffing LACP traffic with wireshark Guy Harris (May 30)