The following syntax adds the vlan tag information as well as the rest of the native vlan traffic for the interface:
tcpdump -ni 1.1
To filter the traffic for a specific VLAN tag ID, use the following syntax:
tcpdump -ni 1.1 vlan
The following syntax displays traffic on interface 1.1 with a VLAN tag ID of 105:
tcpdump -ni 1.1 vlan 105
tcpdump: listening on 1.1
09:39:11.800739 802.1Q vlan#2907 P0 10.24.2.254 > 10.24.2.34: icmp: echo request
09:39:11.800739 802.1Q vlan#2907 P0 10.24.2.34 > 10.24.2.254: icmp: echo reply (DF)
09:39:12.640739 802.1Q vlan#2907 P0 10.24.2.254 > 10.24.2.34: icmp: echo request
09:39:12.640739 802.1Q vlan#2907 P0 10.24.2.34 > 10.24.2.254: icmp: echo reply (DF)
09:39:13.690746 802.1Q vlan#2907 P0 10.24.2.254 > 10.24.2.34: icmp: echo request
09:39:13.690746 802.1Q vlan#2907 P0 10.24.2.34 > 10.24.2.254: icmp: echo reply (DF)
When you specify the VLAN name in the tcpdump syntax, the VLAN header is not present because tcpdump reads the packet after it is copied on switch ingress, processed by the TMM and sent to the Host. On BIG-IP version 9.x and 10.x systems, the hardware manages the VLAN tagging operations.
If you do not want to display the VLAN tagged traffic, you can use the following syntax:
tcpdump -ni internal