The kernel now longer passes vlan tag information as-is to libpcap, instead BPF needs to access ancillary data.
That is the reason "vlan 114" works (because it does the right thing), and a manual filter doesn't, because libpcap never actually sees this. Offsets are negative because this is the way to access this ancillary data (like vlan tags) in the Linux kernel: https://github.com/torvalds/linux/blob/6f0d349d922ba44e4348a17a78ea51b7135965b1/include/uapi/linux/filter.h#L60 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1641429 Title: tcpdump capture filter for vlans incorrect To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/tcpdump/+bug/1641429/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
