Re: vlan and bpf

> How to you believe the vlan traffic should appear, in terms of bits
> in a bpf frame?

I wasn't the one who wrote what you're responding to, but I would
expect to see it just as it is on the wire (I do consider stripping
channel seizure and CRC acceptable):

Ethernet destination
Ethernet MAC
0x8100 (ETHERTYPE_VLAN)
VLAN tag-and-priority
Encapsulated payload:
  Inner-layer ETHERTYPE_*
  Inner-layer payload

> Do you need to know, for each packet, if it was a non-vlan (untagged)
> packet, vs a tagged packet?

I would certainly expect to.  Depending on the reason I'm snooping,
"need" may not be the best word.

> If so, do you need to know what the tag value was?

Again, I would expect to find it in the packet, bytes [14] and [15]
containing the tag and priority, but, depending on the use case, "need"
may or may not be appropriate.

If you're stuck with hardware that insists on stripping VLAN tags, IMO
the only sane thing is to synthesize the stripped 4 octets for
presentation via bpf.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email protected]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B