Ah. And that is why we ask the questions. I didn't think of
moving farther down the stack for the capture filters.
Thanks to everyone who sent the idea.
Todd
On 8/1/2019 8:52 AM, Maynard, Chris via Wireshark-users wrote:
How about a capture filter such as this?
"vlan and not (ether[14:2]&0x0fff = 20 or ether[14:2]&0x0fff = 30)"
- Chris
See also: https://ask.wireshark.org/question/3877/vlan-filter/
-----Original Message-----
From: Wireshark-users [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On
Behalf Of Todd Adamson
Sent: Wednesday, July 31, 2019 6:41 PM
To: Wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] Capture filter with multiple VLANs
Is it possible to create a capture filter to deal with multiple vlans? What I
would like to do is:
not (vlan 20 or vlan 30)
or
not vlan 20 and not vlan 30
So far, from what I've read, only the first vlan element is used in the filter.
Ideas?
Thanks.
Todd
