Hi, For this you have to go lower in the stack and access the packet bytes directly.
Have a look at proto [ expr : size ], where proto is ether. Now you can access the bytes in the ethernet frame directly. So start looking for 8100 as the ethertype, then extend the expression to make comparisons for the VID field in the VLAN header. Hope it helps. Jaap > On 1 Aug 2019, at 00:40, Todd Adamson <tadam...@routers.com> wrote: > > Is it possible to create a capture filter to deal with multiple vlans? What > I would like to do is: > > not (vlan 20 or vlan 30) > or > not vlan 20 and not vlan 30 > > So far, from what I've read, only the first vlan element is used in the > filter. > > Ideas? > > Thanks. > > Todd
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org> Archives: https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
