Debugging tcpdump VLAN in Linksys E8450 with tcpump

Has anyone seen this issue before on openwrt?

 root@home-west:~# tcpdump -i any -n -e '(vlan 1)'
 tcpdump: data link type LINUX_SLL2
 tcpdump: no VLAN support for Linux cooked v2

Version information below if that helps.
|Model|Linksys E7350|
|Architecture|MediaTek MT7621 ver:1 eco:3|
|Target Platform|ramips/mt7621|
|Firmware Version|OpenWrt 23.05.5 r24106-10cc5fcd00 / LuCI openwrt-23.05 branch git-24.346.66847-1bb28ba|

On a linksys e5400 tcpdump for vlan traffic works fine but on a linksys E8450.

First, this is not an OpenWrt issue, and second, I can't believe this ever worked.

Setting a tcpdump filter for a specific vlan ID requires the interface(s) to enter promiscuous mode, which is not the case when using option -i any.

Just specify which interface tcpdump should listen on and start debugging...

1 Like

Thanks for some details. I targeted eth0 and still get no VLAN support on the linksys E8450(OpenWrt 23.05.5, r24106-10cc5fcd00).

root@home-west:~# tcpdump -i eth0 -n -e '(vlan 1)'
tcpdump: no VLAN support for BSD loopback

I really thing this a build issue on the Linksys E8450. On a Linksys E5400(OpenWrt 23.05.5, r24106-10cc5fcd00) tcpdump works fine.

root@building:~# tcpdump -i eth0 -n -e '(vlan 1)'
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

This device is DSA, so valid interfaces are lan[1-4], wan and eventually br-lan.

Pavelgl thanks for the help. Your are 100% correct I just validated. DSA devices need lan[1-4] or wan on tcpdump to target VLAN details. Legacy devices like the E5400 that only support swconfig need to eth0...

root@billsnet-home-west:~# tcpdump -i lan1 -n -e '(vlan 1)'
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on lan1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
01:44:02.300813 80:69:1a:82:1a:3f > c8:5e:a9:65:ed:20, ethertype 802.1Q (0x8500), length 78: vlan 1, p 0, ethertype IPv4 (0x0800), 192.168.1.8 > 192.168.1.214: ICMP echo reply, id 1, seq 5209, length 40