 | 1 | initial version |
Is the following one a valid capture filter for VLAN 2001 traffic
It's valid, but vlan and ether[14:2]&0x0fff=2001 is exactly the same as vlan 2001 ("exactly" as in "generates exactly the same BPF machine code"), at least with recent versions of libpcap.
vlan and (ether[14:2]&0x0fff=2001 or ether[14:2]&0x0fff=2002) will test for VLANs 2001 or 2002.
