Wireshark-users: Re: [Wireshark-users] Filtering both vlan-tagged as untagged frames with an ip-filter

From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 2 May 2007 08:28:28 +0200

Hi Jaap,

> How about "host x.x.x.x" ?

That was the first thing I tried, but unfotunately that filter only
selects the untagged frames. You need to specify the vlan keyword
for wireshark to be able to filter tagged frames. But once you use
vlan anywhere in the capture filter, all untagged frames are no 
longer seen...

Hmmm... I tried some more filters and found one that *does* work :)

Here are the things I tried

host x.x.x.x
-> only shows untagged frames with host x.x.x.x

vlan and host x.x.x.x
-> only shows tagged frames with host x.x.x.x

(vlan or not vlan) and host x.x.x.x
-> only shows tagged frames with host x.x.x.x

(vlan and host x.x.x.x) or host x.x.x.x
-> only shows tagged frames with host x.x.x.x

host x.x.x.x or (vlan and host x.x.x.x)
-> ***WORKS***

Weird!!!

Is this a technical limitation that can't be worked around? Or
is this a bug in the the WinPcap library?

Cheers,


Sake

PS  Thanks for making me try just one more filter ;)