vlan separation

l0rddarkf0rce has asked for the wisdom of the Perl Monks concerning the following question:

I'm trying to write a script that will read a pcap file and then split the traffic by vlan, so for example: 1. read ehternet packet 2. if it has a vlan tag remove the vlan tag and copy the packet to another file called vlanX (where X is the vlan id from the packet) 3. if it doesn't have a vlan tag then copy to a file called novlan Any pointers on how to accomplish this will be appreciated.

Comment on vlan separation

Replies are listed 'Best First'.
Re: vlan separation by Anonymous Monk on Dec 15, 2011 at 16:40 UTC
perlintro, pcap, ?node_id=3989;HIT=pcap;re=N, pcap, Re: HTTP data from TCP packet	[reply]
Re: vlan separation by gman (Friar) on Dec 15, 2011 at 18:21 UTC
You may know this already, but your connection must be setup as a monitor / mirror port on the switch. Or set it up as a trunk and monitor each virtual interface in a different process. UPDATE: Sorry I did not read carefully, you already have the pcap file.	[reply]
Re^2: vlan separation by l0rddarkf0rce (Initiate) on Dec 18, 2011 at 15:13 UTC
I actually have ~ 2TB worth and they all have the vlan tag, unfortunately the program that i'm trying to import them into do not like vlans so I want to remove the tag and thought the easiest way may be to just write a script that would take care of this.	[reply]