Forum Discussion
NimbostratusTCPdump fails to write LACP frames to file
Hello,
I am trying to capture LACP frames with tcpdump which works great on parsing and showing the frames directly on the console. However if I want to save the capture with the -w argument, no frames are captured and saved?
tcpdump -e -vvv -X -s0 -nnni 2.4:nnn38 packets captured
38 packets received by filter
0 packets dropped by kernel
tcpdump -e -vvv -X -s0 -nnni 2.4:nnn -w /shared/test.pcap0 packets captured
0 packets received by filter
0 packets dropped by kernel
How come the LACP frames are not saved to the file?
Have you tried filtering the Protocol Header?
tcpdump -ni -e ether proto 0x8809This article seems relevant:
K2289: Using advanced tcpdump filters
Check the Tracing Ethernet header type LACP
Let me know how it goes and if you have further questions 🙂
Henrik_SI asked my favorite SE who pointed me in the direction of tshark. Tshark does the trick and is able to save the frames, however it seems that I am only able to run one instance of tshark at the time.
