Wireshark · Wireshark-users: [Wireshark-users] Extracting outer MAC Address

[Rayne <hjazz6@xxxxxxxxx>]

Hi all,

I have vlan packets that contain 2 Ethernet headers, and I would like to extract all source MAC addresses from the first (outer) Ethernet header. However, tshark automatically extracts the second (inner) MAC address.

What I have is

tshark -r file.pcap -T fields -e eth.src -w output.pcap

How do I extract only the outer MAC address using tshark?

Thank you.

Regards,

Rayne