I'm running tcpdump on a mirrored port and when I use a simple tcpdump command it shows the VLAN id:
tcpdump -i eth1 -n -e
22:02:53.308715 78:31:c1:c6:c8:9e (oui Unknown) > Broadcast, ethertype 802.1Q (0x8100), length 114: vlan 10, p 0, ethertype IPv4, redacted-MBP.home.redacted.net.netbios-ns > 192.168.10.255.netbios-ns: NBT UDP PACKET(137): REFRESH(8); REQUEST; BROADCAST
However, if I try to filter on the vlan 10 id then it doesn't show any packets:
tcpdump -i eth1 -n -e '(vlan 10)'
What am I doing wrong?