Wireshark · Wireshark-users: [Wireshark-users] Destination capture filtering not working

[Cliff Fogle <cliff@xxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This also applies to tcpdump.

I cannot perform any dst filtering.

dst port 80
dst net x.x.x.x/YY
dst host x.x.x.x

None of these work.  If I do an unfiltered capture and use a display
filter I see these packets, but my capture file quickly grows too large.

Thanks

I attached a dmesg | grep eth0 in case this is a NIC issue:


[   35.561741] eth0: Tigon3 [partno(BCM95752) rev 6001 PHY(5752)] (PCI
Express) 10/100/1000Base-T Ethernet 00:1a:4b:ca:13:d0
[   35.561747] eth0: RXcsums[1] LinkChgREG[0] MIirq[0] ASF[0]
WireSpeed[1] TSOcap[1]
[   35.561749] eth0: dma_rwctrl[76180000] dma_mask[64-bit]
[   40.271840] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   42.549324] tg3: eth0: Link is up at 1000 Mbps, full duplex.
[   42.549327] tg3: eth0: Flow control is off for TX and off for RX.
[   42.551137] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   52.749695] eth0: no IPv6 routers present
[2075134.871297] device eth0 entered promiscuous mode
[2075134.871308] audit(1199390503.683:4): dev=eth0 prom=256 old_prom=0
auid=4294967295
[2075164.770580] device eth0 left promiscuous mode
[2075164.770592] audit(1199390533.685:5): dev=eth0 prom=0 old_prom=256
auid=4294967295
[2076515.578786] device eth0 entered promiscuous mode
[2076515.578802] audit(1199391885.262:6): dev=eth0 prom=256 old_prom=0
auid=4294967295
[2076914.650857] device eth0 left promiscuous mode
[2076914.650866] audit(1199392284.285:7): dev=eth0 prom=0 old_prom=256
auid=4294967295
[2076964.997434] device eth0 entered promiscuous mode
[2076964.997444] audit(1199392334.788:8): dev=eth0 prom=256 old_prom=0
auid=4294967295
[2081541.338801] tg3: eth0: Link is down.
[2081545.972364] tg3: eth0: Link is up at 1000 Mbps, full duplex.
[2081545.972369] tg3: eth0: Flow control is off for TX and off for RX.
[2081791.063414] device eth0 left promiscuous mode
[2081791.063425] audit(1199397163.563:9): dev=eth0 prom=0 old_prom=256
auid=4294967295
[2081806.870860] device eth0 entered promiscuous mode
[2081806.870877] audit(1199397179.564:10): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2083882.924116] device eth0 left promiscuous mode
[2083882.924127] audit(1199399256.682:11): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2083893.334055] device eth0 entered promiscuous mode
[2083893.334065] audit(1199399267.183:12): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2084197.020469] device eth0 left promiscuous mode
[2084197.020480] audit(1199399570.700:13): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2084214.862349] device eth0 entered promiscuous mode
[2084214.862360] audit(1199399588.701:14): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2086211.992970] device eth0 left promiscuous mode
[2086211.992981] audit(1199401586.815:15): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2086252.741769] device eth0 entered promiscuous mode
[2086252.741780] audit(1199401627.817:16): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2088603.174714] device eth0 left promiscuous mode
[2088603.174723] audit(1199403979.451:17): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2088637.906632] device eth0 entered promiscuous mode
[2088637.906642] audit(1199404014.453:18): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2092126.437370] device eth0 left promiscuous mode
[2092126.437380] audit(1199407504.652:19): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2092255.135457] device eth0 entered promiscuous mode
[2092255.135467] audit(1199407633.659:20): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2092274.452414] device eth0 left promiscuous mode
[2092274.452424] audit(1199407653.161:21): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2092279.469550] device eth0 entered promiscuous mode
[2092279.469560] audit(1199407658.161:22): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2092424.334766] device eth0 left promiscuous mode
[2092424.334776] audit(1199407803.169:23): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2092430.047508] device eth0 entered promiscuous mode
[2092430.047520] audit(1199407808.669:24): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2092470.576340] device eth0 left promiscuous mode
[2092470.576350] audit(1199407849.172:25): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2092504.900824] device eth0 entered promiscuous mode
[2092504.900834] audit(1199407883.674:26): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2092529.674710] device eth0 left promiscuous mode
[2092529.674719] audit(1199407908.175:27): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2092742.532946] device eth0 entered promiscuous mode
[2092742.532957] audit(1199408121.187:28): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2092760.502801] device eth0 left promiscuous mode
[2092760.502811] audit(1199408139.188:29): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2092771.040650] device eth0 entered promiscuous mode
[2092771.040659] audit(1199408149.689:30): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2093548.052641] device eth0 left promiscuous mode
[2093548.052651] audit(1199408927.233:31): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2093559.614119] device eth0 entered promiscuous mode
[2093559.614128] audit(1199408938.734:32): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2093585.788123] device eth0 left promiscuous mode
[2093585.788133] audit(1199408965.235:33): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2093601.470096] device eth0 entered promiscuous mode
[2093601.470105] audit(1199408980.736:34): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2158551.932642] device eth0 left promiscuous mode
[2158551.932653] audit(1199473968.440:35): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2158560.947364] device eth0 entered promiscuous mode
[2158560.947374] audit(1199473977.440:36): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2158595.951335] device eth0 left promiscuous mode
[2158595.951345] audit(1199474012.442:37): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2158723.186820] device eth0 entered promiscuous mode
[2158723.186832] audit(1199474139.449:38): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2158855.556214] device eth0 left promiscuous mode
[2158855.556224] audit(1199474271.957:39): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2158873.640761] device eth0 entered promiscuous mode
[2158873.640774] audit(1199474290.458:40): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2158940.001284] device eth0 left promiscuous mode
[2158940.001295] audit(1199474356.462:41): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2158966.787439] device eth0 entered promiscuous mode
[2158966.787450] audit(1199474383.463:42): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2158966.803403] device eth0 left promiscuous mode
[2158966.803408] audit(1199474383.463:43): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2158985.420810] device eth0 entered promiscuous mode
[2158985.420821] audit(1199474401.964:44): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2159354.485763] device eth0 left promiscuous mode
[2159354.485774] audit(1199474771.485:45): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2159891.163428] device eth0 entered promiscuous mode
[2159891.163443] audit(1199475308.516:46): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2159966.576031] device eth0 left promiscuous mode
[2159966.576041] audit(1199475383.520:47): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2159974.863352] device eth0 entered promiscuous mode
[2159974.863364] audit(1199475392.021:48): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2159988.343596] device eth0 left promiscuous mode
[2159988.343606] audit(1199475405.522:49): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2160004.014644] device eth0 entered promiscuous mode
[2160004.014653] audit(1199475421.022:50): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2160141.252241] device eth0 left promiscuous mode
[2160141.252251] audit(1199475558.530:51): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2160214.346471] device eth0 entered promiscuous mode
[2160214.346480] audit(1199475631.534:52): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2160230.629132] device eth0 left promiscuous mode
[2160230.629142] audit(1199475648.035:53): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2160246.500197] device eth0 entered promiscuous mode
[2160246.500206] audit(1199475664.036:54): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2160261.787363] device eth0 left promiscuous mode
[2160261.787373] audit(1199475679.037:55): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2160276.319042] device eth0 entered promiscuous mode
[2160276.319052] audit(1199475693.538:56): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2160965.253360] device eth0 left promiscuous mode
[2160965.253369] audit(1199476383.077:57): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2160978.741616] device eth0 entered promiscuous mode
[2160978.741627] audit(1199476396.578:58): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2160978.757588] device eth0 left promiscuous mode
[2160978.757593] audit(1199476396.578:59): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2160993.709133] device eth0 entered promiscuous mode
[2160993.709143] audit(1199476411.579:60): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2160999.466585] device eth0 left promiscuous mode
[2160999.466596] audit(1199476417.079:62): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2161042.417216] device eth0 entered promiscuous mode
[2161042.417226] audit(1199476460.082:64): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2161042.436876] device eth0 left promiscuous mode
[2161042.436885] audit(1199476460.082:65): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2161052.827393] device eth0 entered promiscuous mode
[2161052.827402] audit(1199476470.582:66): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2161052.840435] device eth0 left promiscuous mode
[2161052.840441] audit(1199476470.582:67): dev=eth0 prom=0
old_prom=256 auid=4294967295
[2161068.594449] device eth0 entered promiscuous mode
[2161068.594459] audit(1199476486.583:68): dev=eth0 prom=256
old_prom=0 auid=4294967295
[2161081.973546] device eth0 left promiscuous mode
[2161081.973559] audit(1199476499.584:69): dev=eth0 prom=0
old_prom=256 auid=4294967295





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHfpaU64Kvi7PwWiQRAkc0AJ4+8s45FWYsq2tUv0QWuN1trMwUtACfUI40
Pin4+yuS/tCLtoQ1D7fvqQ0=
=RPUu
-----END PGP SIGNATURE-----