Skip to content

Filters not working with pcap including VLAN (802.1Q) #1322

@awgn

Description

@awgn

Tcpdump is not able to filter packets in pcap files when ethertype 802.1Q header is present:

$ tcpdump --version
tcpdump version 4.99.0
libpcap version 1.10.0
OpenSSL 1.1.1i 8 Dec 2020

$ tcpdump -n -e -r ./test.pcap
reading from file ./test.pcap, link-type EN10MB (Ethernet), snapshot length 1500
12:23:40.763084 xx:xx:d4:82:38:24 > xx:xx:xx:43:66:40, ethertype 802.1Q (0x8100), length 76: vlan 31, p 0, ethertype IPv4 (0x0800), 10.11.27.62.53 > 10.15110.19.45002: 8089 Refused- 0/0/0 (30)
...

$ tcpdump -n -e -r ./test.pcap ip
reading from file ./test.pcap, link-type EN10MB (Ethernet), snapshot length 1500
$ (no packet is shown)

Most probably the same issue is present for IPv6 packets.

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions