First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Using a vlans file in profile

Problem

I am trying to get VLAN resolution to work in both wireshark and tshark using a SampleCaptures vlan pcap. This pcap contains all sorts of vlans, including a vlan 7.

Description

Tested on Macos (v3.0.3), Linux (v2.6.8).

I have a vlan_profile folder in ~/.config/wireshark/profiles that contains this vlans file:

7 native
Using tshark, the name resolution is to "<7>". 
bash$ tshark -r vlan.cap -Nv -C vlan_profile -T fields -e vlan.id_name -Y "vlan.id==7" -2 -o "nameres.vlan_name:true"
<7>
<7>
<7>
<7>
<7>

Using Wireshark configured with the vlan_profile profile, I get no packet results when filtering by not vlan.id_name matches "<[0-9]+>" and vlan.id_name. When using Wireshark, I have the "Resolve VLAN IDs" checkmark checked in Preferences.

Question

How is the vlans file used for vlan resolution?

Ross Jacobs's avatar
71
Ross Jacobs
asked 2019-08-12 00:10:37 +0000, updated 2019-08-12 00:31:01 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

1

Please try to put the vlan file in ~/.config/wireshark/ directly. There was a bug in 3.0.2 and it could be that the bugfix did not made into 3.0.3. I haven’t tested it, so far.

Christian_R's avatar
2.1k
Christian_R
answered 2019-08-12 10:59:54 +0000, updated 2019-08-12 22:41:39 +0000
edit flag offensive 0 remove flag delete link
more

Comments

I see this problem on both 2.6.8 AND 3.0.2, but moving the vlans file to ~/.config/wireshark fixed. Can you provide the fixing commit/link to it to the commit?

Ross Jacobs's avatar Ross Jacobs (2019-08-12 13:22:09 +0000) edit
more
  • delete

Possibly change 33378 and a follow on 33384. These changes don't appear to have been backported.

grahamb's avatar grahamb (2019-08-12 13:47:39 +0000) edit
more
  • delete

Thanks Graham! I can rebuild to v3.1.0

Ross Jacobs's avatar Ross Jacobs (2019-08-12 19:24:26 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer