Reading directly from tcpdump stdout fails

[uberhalit]

When trying to read the output of tcpdump with pcap.OpenOfflineFile(os.Stdin) one will continously receive io.EOF error but not a single valid packet.

tcpdump is used like tcpdump -i eth0 -U -s0 -w - | mygopacketapplication. Flag -w - will direct pcap output to standard output.

Wireshark can read from stdin like stated above just fine (using -k -i -). But even when saving this capture from within wireshark and then opening via pcap.OpenOffline("wireshark_capture_from_stdin.pcap") all one will recieve is io.EOF.

[uberhalit]

After manually hex-editing some pcap files I've found the culprit:
tcpdump will insert a VLAN (802.1Q) layer when capturing from a virtual device. However there is a bug regarding BPF when you try to chain together some 'vlan' expressions: the-tcpdump-group/libpcap#158

So instead of vlan or ( tcp port 1111 or 2222 ) one would use ( tcp port 1111 or 2222 ) or vlan. Otherwise you'll never see any normal tcp traffic.

[uberhalit]

After manually hex-editing some pcap files I've found the culprit:
tcpdump will insert a VLAN (802.1Q) layer when capturing from a virtual device. However there is a bug regarding BPF when you try to chain together some 'vlan' expressions: the-tcpdump-group/libpcap#158

So instead of vlan or ( tcp port 1111 or 2222 ) one would use ( tcp port 1111 or 2222 ) or vlan. Otherwise you'll never see any normal tcp traffic.