Ask Your Question

Using a vlans file in profile

asked 2019-08-12 00:10:37 +0000

Ross Jacobs gravatar image

updated 2019-08-12 00:31:01 +0000


I am trying to get VLAN resolution to work in both wireshark and tshark using a SampleCaptures vlan pcap. This pcap contains all sorts of vlans, including a vlan 7.


Tested on Macos (v3.0.3), Linux (v2.6.8).

I have a vlan_profile folder in ~/.config/wireshark/profiles that contains this vlans file:

7 native
Using tshark, the name resolution is to "<7>".
bash$ tshark -r vlan.cap -Nv -C vlan_profile -T fields -e vlan.id_name -Y "" -2 -o "nameres.vlan_name:true"

Using Wireshark configured with the vlan_profile profile, I get no packet results when filtering by not vlan.id_name matches "<[0-9]+>" and vlan.id_name. When using Wireshark, I have the "Resolve VLAN IDs" checkmark checked in Preferences.


How is the vlans file used for vlan resolution?

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted

answered 2019-08-12 10:59:54 +0000

updated 2019-08-12 22:41:39 +0000

Please try to put the vlan file in ~/.config/wireshark/ directly. There was a bug in 3.0.2 and it could be that the bugfix did not made into 3.0.3. I haven’t tested it, so far.

edit flag offensive delete link more


I see this problem on both 2.6.8 AND 3.0.2, but moving the vlans file to ~/.config/wireshark fixed. Can you provide the fixing commit/link to it to the commit?

Ross Jacobs gravatar imageRoss Jacobs ( 2019-08-12 13:22:09 +0000 )edit

Possibly change 33378 and a follow on 33384. These changes don't appear to have been backported.

grahamb gravatar imagegrahamb ( 2019-08-12 13:47:39 +0000 )edit

Thanks Graham! I can rebuild to v3.1.0

Ross Jacobs gravatar imageRoss Jacobs ( 2019-08-12 19:24:26 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-08-12 00:10:37 +0000

Seen: 362 times

Last updated: Aug 12 '19