Hello,
I've spent some time playing with tcpdump and pcap with regard
to vlans. Using libpcap 1.0.0 + tcpdump 4.0.0, I can able to
correctly dump packets including (reconstructed) vlan headers.
But it seems that using the vlan filter keyword does not work.
example:
$ tcpdump -e -i eth1
13:10:0
> I've spent some time playing with tcpdump and pcap with regard
> to vlans. Using libpcap 1.0.0 + tcpdump 4.0.0, I can able to
> correctly dump packets including (reconstructed) vlan headers.
> But it seems that using the vlan filter keyword does not work.
Can't answer for Linux, but VLAN filt
Ouch,
I also forgot to mention I've also tried todays libpcap git snapshot.
n.
On Mon, Jun 08, 2009 at 01:47:41PM +0200, Nikola Ciprich wrote:
> Hello,
>
> I've spent some time playing with tcpdump and pcap with regard
> to vlans. Using libpcap 1.0.0 + tcpdump 4.0.0, I can able to
> correctly d
> "Nikola" == Nikola Ciprich writes:
Nikola> Hello,
Nikola> I've spent some time playing with tcpdump and pcap with
Nikola> regard to vlans. Using libpcap 1.0.0 + tcpdump 4.0.0, I can
Nikola> able to correctly dump packets including (reconstructed)
Nikola> vlan headers. B
Hi Michael,
saving the traffic to file first and trying the filter while loading the
dump works. Same case when trying vlan filtering in virtual hosts using
virtio interface, so the problem must be related to vlan acceleration somehow.
But I though that for 2.6.29 vlan acceleration should be disabl
On Jun 8, 2009, at 4:47 AM, Nikola Ciprich wrote:
I've spent some time playing with tcpdump and pcap with regard
to vlans. Using libpcap 1.0.0 + tcpdump 4.0.0, I can able to
correctly dump packets including (reconstructed) vlan headers.
But it seems that using the vlan filter keyword does not w
On Jun 10, 2009, at 11:12 AM, Guy Harris wrote:
There are special hooks in Linux's BPF interpreter to allow
filtering on some data that's not in the packet data; libpcap
already uses that to handle fields in the constructed DLT_LINUX_SLL
header (it generates code assuming the header is at
Hi Guy,
thanks for your replies. OK, I see. I'm pretty ignorant in this area,
so please forgive my maybe dumb questions. So couldn't the solution
be in disabling hw VLAN headers stripping and letting the kernel do
the job for the time of dumping? The same way as it works for example
when using thi
On Jun 11, 2009, at 1:12 AM, Nikola Ciprich wrote:
thanks for your replies. OK, I see. I'm pretty ignorant in this area,
so please forgive my maybe dumb questions. So couldn't the solution
be in disabling hw VLAN headers stripping and letting the kernel do
the job for the time of dumping?
If
