I am trying to capture traffic of ethertype 0x88b8. Some of them may be vlan tagged and some of them might not be, but the and and or operators are not behaving in the way I expect.

My first attempt was this:

(vlan and ether proto 0x88b8) or ether proto 0x88b8

I tested this capture filter on two separate laptops simultaneously, one of which receives the vlan tagged packets and other which receives the non-tagged packets.

In this case the one receiving the non-tagged packets received nothing.

I dug around and found on the pcap filter man-page and found this:

Negation has highest precedence. Alternation and concatenation have equal precedence and associate left to right.

So I though order mattered somehow. So after a bit of trial-and-error I settled on this:

ether proto 0x88b8 or (vlan and ether proto 0x88b8)

and this worked on both laptops.

Has my testing yielded the correct expression? Is it redundant in some way? Why are they different and why does the latter one work? Is there anything else I should be aware of?


You stumbled into the correct filter. If you dig into enough, you'll find the vlan directive changes the packet matching offsets from that point forward in the filter. So you need to have all your non-tagged matches before any tagged matches.

(you can tell tcpdump to dump the BPF "program" based on your filter expression and see the effect vlan has.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.