Wireshark · Wireshark-users: Re: [Wireshark-users] Capture Filter not work for hub, seems like a bug?

[Tao Zhou <moonese@xxxxxxxxx>]

Hi, Gerald Combs:

"pppoes && port 80" just works like a magic!

Thanks for help!

Tao, Regards.

On Thu, Aug 27, 2009 at 12:42 AM, Gerald Combs <gerald@xxxxxxxxxxxxx> wrote:

Tao Zhou wrote:
> Yes, the http traffic is on port 80, not on other ports.
>
> as I said in the first email, that if I use 'Display Filter' as http
> while leaving the 'Capture Filter' empty, the http traffic could be
> filtered out on port 80;
> However, if use 'port 80' as 'Capture Filter' while leaving 'Display
> Filter' empty, no traffic could be captured.
>
> But today I found that the laptop NIC card has not obtained a valid IP
> address, as it uses DHCP; while STB got an public network IP address
> through PPPoE.
> So I guess maybe the root cause is that without an IP address for
> laptop, the 'Capture Filter' will make it could not capture any packets;
> while leaving it empty will get all packets in the hub successfully.

Are you trying to apply a capture filter to PPPoE traffic? If so, you
might want to try something like "pppoes && port 80". According to the
tcpdump man page you need to use it in order for your filter to use the
proper offsets.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe