Match traffic with an SVLAN of 100 and any CVLAN: Match any traffic with at least one VLAN tag: Match Cisco CDP / VTP / DTP / PAgP / UDLD: 'ether dst 01:00:c2:00:00:00' (manpages say 'ether proto stp' but I've had trouble with that) Note: if you want to strip off VLAN, MPLS, PPPoE or GRE headers from an existing pcap file, please see this post: Removing VLAN/MPLS/PPPoE/GRE Encapsulation Please comment if there is something you think I have missed or would like added. The filters are broadly grouped by purpose and I will try to add more as I think of them.

These are capture filters, not display filters, and are equally applicable to Wireshark, tshark and tcpdump, since they all use the same pcap filter syntax. In wireshark the capture filter options are now hidden away and you have to double click on the interface under capture options to set or adjust the filter string. Since most of the hits on this blog seem to come from tshark filter related searches, and since I spend a good part of my day either running or analysing packet captures, I thought it might be useful to create a series of 'tshark one-liners' in homage to the brilliant 'sed one-liners' collection compiled by Eric Pement.

Tshark display filter