How to extract Ethernet level data from pcap file?
Question: I have some pcap files, previously I used tshark combined python to extract
source IP address, timestamp, ect.

However, now I open these pcap files in Wireshark. It also contains the VLAN
info, VID is the thing I want to extract right now.

I use `tshark -r xx.pcap` in the terminal, it can only show the tcp level
info, I can not get this VLAN ID. Does anyone one know how to do it in Python?
use some library or tool?


Answer: the perfect solution is [Scapy](http://www.secdev.org/projects/scapy/)

In this example i create a packet with vlan and then print the vlan ID

    
    
    from scapy.all import *
    pkt=Ether()/Dot1Q(vlan=0x32)/IP(dst="192.168.1.66")/ICMP()
    print pkt[Dot1Q].vlan
    

and this example shows how to read a pcap file and print the VLAN ID

    
    
    from scapy.all import *
    from scapy.utils import *
    pkts=rdpcap("filename.pcap")
    for pkt in pkts:
        if pkt.haslayer(Dot1Q):
            print pkt[Dot1Q].vlan 
    

tested and works perfect.

