Systura Where information becomes knowledge...

I use tcpdump a lot in when I am trouble shooting a problem and recently I had to trouble shoot a problem on a vlan trunked interface.  So, I would normally do something like:

tcpdump -i eth1 host 10.1.1.1 and host 10.2.1.1

But, because the interface was trunked, I saw no traffic.  After doing a quick search on the Internet, I found that I needed to add the "vlan <vlan id>" to my filter, which became:

tcpdump -i eth1 vlan 801 and host 10.1.1.1 and host 10.2.1.1

Now, I could see everything.