Wireshark · Ethereal-users: [Ethereal-users] Sniffing L2TP tunnel traffic and estimating bandwidth

[Sam Stickland <sam_ml@xxxxxxxxxxxxxx>]

Hi,

I'm looking to estimate the bandwidth in use for a network that is routed 
inside an L2TP tunnel.

If I specify either of the two L2TP tunnel enpoints in the filter 
expression then I see tethereal decode the tunnel traffic. However, now I 
am already specifying a host in the filter expression, I can't specify 
additional filters for the traffic inside the L2TP tunnel.

For example, if hosts A and B are in the tunnel with endpoints E1 and 
E2 then:

tethereal -eth1
	Shows traffic between E1 and E2

tethereal "host E1" -ieth1
	Shows all traffic for hosts A and B

tethereal "host E1 and host A" -eth1
	Matches nothing

I've been able to achieve something of what I need by mixing filter and 
display strings, but I think I really need to do all of this in a filter 
expression (I'd like to be corrected).

Secondly, I'd like to be able to analyse the traffic matching the filter 
expression for bandwdith usage. I've been told that this is possible with 
tethereal, but I can't find it in the documentation.

Any help would be appreciated!

Sam