Hello all,
I'm using tshark to parse a captured packet. Most fields are easy to
grab, but I can't figure out how to grab both VLAN tags from a stacked
Ethernet frame. The following command returns the inner (2nd) VLAN ID:
tshark -r test.pcap -c 1 -T fields -e vlan.id
I tried using vlan.id[0], vlan[0].id, etc. to no avail. I also tried
the following, which returns nothing in the first column and the inner
VLAN in the second column:
tshark -r test.pcap -c 1 -T fields -e vlan.id -e vlan.id
I know tshark can process the fields correctly because the detailed XML
and verbose options show both VLANs parsed out. I could parse those
outputs, but I really don't want to do it that way.
Does anyone know how to handle multiple matches for using the same field
name?
Thanks in advance.
Chris
