print vlan number

[richard lucassen]

Hello list,

Just a simple question: I have eth1 with some VLAN's. When tcpdumping
with:

# tcpdump -h
tcpdump version 3.9.8
libpcap version 0.9.8

the vlan tags are printed using "tcpdump -ni eth1":

10:16:12.068967 vlan 65, p 0, IP 10.65.0.196.49189 > 10.2.131.14.2598

But using a newer version, the tags have disappeared:

# tcpdump -h
tcpdump version 4.3.0
libpcap version 1.3.0

10:48:41.551598 IP 192.168.206.188 > 192.168.206.1

I'd expect:

10:48:41.551598 vlan 259, p 0, IP 192.168.206.188 > 192.168.206.1

Is this a bug or has this been changed?

R.

[Guy Harris]

Post by richard lucassen
Just a simple question: I have eth1 with some VLAN's. When tcpdumping
# tcpdump -h
tcpdump version 3.9.8
libpcap version 0.9.8
10:16:12.068967 vlan 65, p 0, IP 10.65.0.196.49189 > 10.2.131.14.2598

I can find nothing in the standard tcpdump 3.9.8 code that would cause the VLAN tags to be printed if you haven't specified the -e flag to tcpdump.

Is this standard tcpdump 3.9.8, downloaded in source form from tcpdump.org, and compiled, or is it some version of tcpdump provided by the supplier of your OS? If it's the latter, what OS is that (for Linux, as I suspect this is from "eth1", what distribution is it), and what version (for Linux, what's the version of the distribution, not of the kernel)?

[richard lucassen]

On Mon, 16 Jun 2014 13:11:22 +0200

Post by richard lucassen
Is this a bug or has this been changed?

Are you using Debian or a derivative like Ubuntu? The tcpdump package
used to have a patch to reverse the meaning of the -e flag, but it was
dropped a few years ago. If you want to see the vlan id, you need to
use -e.

That's it. The tcpdump printing VLANs was Ubuntu-8.04, the other a
Debian Squeeze. The -e does the job, thnx for your answer. Thnx to Guy
as well for his reply.

R.