Wireshark-users: [Wireshark-users] Filtering both vlan-tagged as untagged frames with an ip-filter

From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 1 May 2007 22:22:08 +0200

Hi all,

While analysing a problem today I discovered that I had missed packets in
my session after capturing with a filter like "vlan and host x.x.x.x".
After making a trace with no filter, I could see that packets in one
direction were tagged, while they were not tagged in the other direction.
Then I triesd a filter like "(vlan or not vlan) and host x.x.x.x", but
that just doesn't work.

Does anyone know how to capture both vlan-tagges frames and untagged
frames with an ip-address filter?

Might this be a WinPcap bug?


Cheers,


Sake


Oh BTW, system info is:

Version 0.99.6-SVN-21299 (SVN Rev 21299)

Copyright 1998-2007 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.10.11, with GLib 2.12.11, with WinPcap (version unknown),
with libz 1.2.3, with libpcre 6.4, with Net-SNMP 5.4, with ADNS, with Lua 5.1,
with GnuTLS 1.6.1, with Gcrypt 1.2.3, with MIT Kerberos, with PortAudio
PortAudio V19-devel, with AirPcap.

Running on Windows Server 2003 Service Pack 1, build 3790, with WinPcap version
4.0 (packet.dll version 4.0.0.755), based on libpcap version 0.9.5, without
AirPcap.

Built using Microsoft Visual C++ 6.0 build 8804

Wireshark is Open Source Software released under the GNU General Public License.

Check the man page and http://www.wireshark.org for more information