1 | initial version |
Unfortunately the VLAN information is passed through as auxiliary data to the socket. Libpcap, the library that's actually interfacing with the network on behalve of Wireshark, does a lot of work to re-insert the VLAN data into the frame. See the pcap-linux.c file and search for 'vlan'.