Wireshark · Wireshark-users: Re: [Wireshark-users] need help with stp capture filter

[Sake Blok <sake@xxxxxxxxxx>]

On 3 aug 2010, at 16:55, Joe Dewberry wrote:

> I'm working on a project where I need a capture filter to see only the BPDUs that have the tcn bit set == 1.

On my non-vlan tagged network STP starts at offset 17 in the ethernet frame (14 bytes ethernet, 3 bytes LLC). Looking at the STP frame, the flags are at offset 4. The TC flag is the lowest bit. That would result in a filter like:

ether[21] & 1 = 1

Hope this helps,
Cheers,


Sake